搜索和下载歌曲海(gequhai.com)的音乐，支持搜索歌曲、获取下载链接（优先无损/高品质）， 并可一键下载到群晖NAS。当用户询问歌曲、搜索音乐、或想下载歌曲时使用此技能。

Do not install this skill on a machine that has access to sensitive local resources or your real NAS without first auditing and changing it. Key points to consider before using: - Hardcoded NAS credentials: scripts/gequhai_crawler.py contains SYNOLOGY_HOST, SYNOLOGY_USER, SYNOLOGY_PASS (values provided). This is a major red flag — change them to require user-supplied values or remove defaults. - Auto-registration and background tasks: service/main.py will POST to a Skill Gateway on startup and run a background rename processor every 30 seconds. This causes periodic outbound network activity and registers the service endpoint; if you don't want that, either disable startup registration or run the service in a restricted network. - The skill runs a FastAPI web service exposing /search, /detail, /download endpoints. If you run it, it will listen on a host/port and could be reachable; run in an isolated/containerized environment and restrict network access. - There is a truncated/buggy part in gequhai_crawler.py (a 'return da' appears in the provided excerpt) — the code may not be fully functional and should be reviewed/tested before use. - Legal/ethical: the skill scrapes and downloads music; consider copyright and terms of service for the target site and any files you download. Recommended actions: 1) Inspect the full code (download_song, auto_process_downloads, process_rename_queue) before running. Ensure there are no hidden exfiltration paths. 2) Remove hardcoded credentials; require the user to provide SYNOLOGY_* values via environment variables or a config file. 3) Disable automatic gateway registration (set SKILL_GATEWAY_URL to a safe value or modify startup behavior) if you don't want the skill to advertise itself. 4) Run the service in a sandbox or container with restricted outbound/inbound network rules while testing. 5) If you do not trust the author, prefer not to run the service on networks where the hardcoded credentials could access real devices. If you provide additional information (full untruncated gequhai_crawler.py and confirmation whether the included passwords are placeholders), I can raise or lower the assessment confidence.

Type: OpenClaw Skill Name: gequhai-music Version: 1.0.1 The skill bundle contains hardcoded credentials for a Synology NAS (user 'xiaoai', password 'Xx654321') and hardcoded local Windows file paths (e.g., 'C:\Users\an\...') across multiple files including gequhai_crawler.py and get_hot.py. While the code's logic is consistent with its stated purpose of downloading and organizing music, the inclusion of plaintext credentials and broad file management capabilities (rename, move, list) on network-attached storage represents a significant security risk and poor practice. No evidence of intentional data exfiltration to external third parties was found, but the hardcoded sensitive data makes the bundle unsafe for general deployment.