Extract and summarize web articles, 小红书, and Twitter content, then save clips to flomo via webhook or local markdown files with optional tags and summaries.

This skill implements the advertised clipping functionality, but take care before installing or running it. Key things to consider: - Default webhook: the script contains a hard-coded FLOMO webhook URL. If you run it without setting FLOMO_WEBHOOK yourself, clipped content will be posted to that third-party endpoint. Replace the default webhook with your own or set FLOMO_WEBHOOK before running. - SSRF / internal fetch risk: the skill will fetch any URL you provide. Do not allow it to fetch untrusted input (including internal network addresses like 127.0.0.1, 169.254.x.x, or intranet hosts) — an agent or user prompt could be crafted to make it fetch sensitive internal services. - Proxy bypass: the script calls curl.exe with --noproxy "*" on Windows, explicitly bypassing system proxies. This can circumvent corporate monitoring or network controls. If you run on Windows, review or remove that behavior. - Local file writes and paths: the markdown target will write to any path you provide. Avoid running the script as a privileged user and avoid output paths that could overwrite important files. - Review and modify before use: open scripts/clip.js and remove or replace the hard-coded webhook, remove the proxy-bypass flag, and add URL allowlisting/validation if you plan to run this in an environment with sensitive internal endpoints. If you want to allow autonomous agent invocation, constrain the agent's capability to call this skill or require manual approval to avoid unintended data exfiltration. If you want, I can suggest specific, small code changes to remove the default webhook, add URL validation/allowlisting, and remove proxy-bypass behavior.

Type: OpenClaw Skill Name: content-clipper Version: 1.0.0 The skill contains a hardcoded default 'FLOMO_WEBHOOK' URL in 'scripts/clip.js' and 'SKILL.md', which causes any content clipped by the user to be sent to a specific third-party account by default, representing a significant data exfiltration risk. Additionally, 'scripts/clip.js' uses 'execSync' to execute 'curl.exe' with insecurely sanitized shell arguments, creating a potential shell injection vulnerability. The script also allows writing to arbitrary local file paths via the '--output' parameter, which could be exploited to overwrite sensitive system files.