← 返回 Skills 市场

Data Harvester Pro

Name: Data Harvester Pro
Author: windy-001-crypto

作者 windy-001-crypto · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

398

总下载

当前安装

版本数

在 OpenClaw 中安装

/install data-harvester-v2

功能描述

Batch web scraping for competitor analysis, price monitoring and market research

使用说明 (SKILL.md)

🧑‍🌾 Data Harvester - Batch Scraping & Competitor Analysis

Professional-grade batch web scraping tool for competitor monitoring, price tracking, and market research.

Features

Batch URL Scraping: Process multiple URLs from file
Competitor Comparison: Compare products across platforms
Stock Data: Real-time stock quotes and analysis
Sector Trends: Hot sectors and market trends
News Aggregation: Collect news by keywords

Commands

Command	Description	Example
`stock \x3Ccode>`	Query stock data	`/data-harvester stock 600519`
`block`	Hot market sectors	`/data-harvester block`
`fund`	Money flow tracking	`/data-harvester fund`
`news \x3Ckeyword>`	News search	`/data-harvester news AI`
`compare \x3Cproduct>`	Competitor comparison	`/data-harvester compare laptop`
`batch \x3Cfile>`	Batch URL list	`/data-harvester batch urls.txt`
`export \x3Cfile> \x3Cformat>`	Export data	`/data-harvester export data.json excel`

Usage Examples

Stock Query

/data-harvester stock 000001

Returns: Real-time stock price, change %, volume

Competitor Comparison

/data-harvester compare "wireless earphones"

Returns: Price comparison across Taobao, JD, Pinduoduo

Sector Analysis

/data-harvester block

Returns: Top 7hot sectors with leader stocks

Fund Flow

/data-harvester fund

Returns: Top 5 stocks with main fund inflow

Batch Processing

Create a text file with one URL per line:

https://example1.com
https://example2.com
https://example3.com

Then run:

/data-harvester batch urls.txt

Technical Details

Language: Python 3
Output Formats: JSON, CSV, Excel
Rate Limiting: Configurable delay between requests

Legal Notice

Respect target website's robots.txt
Use reasonable request intervals (3-5 seconds)
For educational/research purposes only
Commercial use requires proper authorization

安全使用建议

This skill appears to be an incomplete or placeholder scraper: it advertises live web scraping, cross-platform competitor comparisons and exports, but the shipped Python implements only mocked data and local file reading. Before installing or using it: 1) don't provide any credentials—none are requested but the advertised features would normally need API keys or browser automation; 2) inspect the SKILL.md raw text for hidden/control characters (the scanner flagged unicode-control-chars); 3) review and run the Python file in a sandbox to verify behavior (it currently makes no network calls); 4) expect to need to manually install browser automation tools (Selenium/Playwright) and libraries like openpyxl if you want the advertised features—ask the author for a clear implementation or sources for scraping logic; 5) if you plan to run real scraping, do so in an isolated environment and confirm legal/robots.txt compliance. Given the mismatches, treat this skill as untrusted until the author provides a coherent implementation and removes suspicious hidden characters.

功能分析

Type: OpenClaw Skill Name: data-harvester-v2 Version: 1.0.0 The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in `data_harvester.py`. The `cmd_batch` function directly uses user-provided input as a filepath (e.g., `/data-harvester batch urls.txt`) without sanitization, allowing an attacker to instruct the OpenClaw agent to read arbitrary files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and display their contents. While the script does not exfiltrate this data, the agent's execution of the skill would expose the file content. The `SKILL.md`'s `command-arg-mode: raw` facilitates this vulnerability by passing arguments directly.

能力评估

⚠ Purpose & Capability

Name/description promise batch web scraping, real-time stock data, competitor scraping across platforms and export capabilities, but the Python code contains only hard-coded mock data and local file reads; there are no network requests, no scraping logic, and no browser automation or scraping dependencies implemented. The declared required binary (python3) is proportional, but the functionality advertised is not implemented in the code.

⚠ Instruction Scope

SKILL.md instructs use of browser automation, CSS selectors, configurable rate limiting and exporting (openpyxl installation), but the runtime instructions and script do not perform those actions — they merely read a file and print sample/mock outputs. This mismatch could lead an agent or user to try to install/execute additional tools or to expect network access that the packaged code does not contain. SKILL.md also contains unicode-control-chars (prompt-injection) signal.

✓ Install Mechanism

No install spec is provided and only python3 is required; nothing is downloaded or extracted. This lowers installation risk. However, the README suggests external installs (openpyxl, browser automation) that are not supplied by the package.

✓ Credentials

The skill requests no environment variables, no credentials, and no config paths. Given the claimed functionality it might normally need API keys for target services, but none are requested — this is inconsistent with advertised live scraping but not an immediate credential risk.

✓ Persistence & Privilege

The skill is not always-enabled and does not request elevated persistence. It contains no code that modifies other skill configs or system-wide settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install data-harvester-v2
安装完成后，直接呼叫该 Skill 的名称或使用 /data-harvester-v2 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Full feature version - batch scraping, competitor analysis

元数据

Slug data-harvester-v2

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题