每天早上生成反诈简报：查询中国国内银行以及支付机构等反欺诈新闻，需要详细的反诈信息。 Use when: 用户说"生成今日反诈简报"，或 cron 在早上 8 点触发。 NOT FOR: 国外银行或金融机构的新闻。

This skill's goal (daily Chinese anti-fraud brief) is reasonable, but there are important gaps and ambiguities: it mentions scraping WeChat public accounts and pushing reports to Feishu but supplies only a simple Baidu-scraping shell script and declares no credentials. Before installing, ask the publisher to: (1) explain how Feishu posting will be authenticated and add explicit env var names (e.g., FEISHU_TOKEN) if needed; (2) clarify how 微信公众号 content will be accessed (API vs scraping) and provide code or required credentials; (3) add robust scraping/parsing (and rate-limiting and robots.txt/legal checks) rather than brittle HTML greps; (4) fix portability issues (grep -P dependency) or implement a more portable parser. Do not provide production credentials or secrets until integrations and required env vars are explicit and reviewed. If you plan to run it, test in an isolated environment and monitor outbound network activity.

Type: OpenClaw Skill Name: daily-antifraud-report Version: 1.0.0 The skill is designed to generate anti-fraud reports by scraping Chinese news sites, but it contains a shell injection vulnerability in `scripts/search_cn.sh`. The script passes the `$QUERY` variable directly into a `curl` command without sanitization or proper quoting, which could allow for arbitrary command execution if the input is manipulated. While the workflow in `SKILL.md` aligns with the stated purpose, the lack of input handling in the shell script poses a security risk.