功能描述

Scrape a public Letterboxd user's watchlist into a CSV/JSONL list of titles and film URLs without logging in. Use when a user asks to export, scrape, or mirror a Letterboxd watchlist, or to build watch-next queues.

使用说明 (SKILL.md)

Letterboxd Watchlist Scraper

Name: Letterboxd Watchlist
Author: 0xnuminous

Use the bundled script to scrape a public Letterboxd watchlist (no auth). Always ask the user for the Letterboxd username if they did not provide one.

Script

scripts/scrape_watchlist.py

Basic usage

uv run scripts/scrape_watchlist.py \x3Cusername> --out watchlist.csv

Robust mode (recommended)

uv run scripts/scrape_watchlist.py \x3Cusername> --out watchlist.jsonl --delay-ms 300 --timeout 30 --retries 2

Output formats

--out *.csv → title,link
--out *.jsonl → one JSON object per line: { "title": "…", "link": "…" }

Notes / gotchas

Letterboxd usernames are case-insensitive, but must be exact.
The script scrapes paginated pages: /watchlist/page/\x3Cn>/.
Stop condition: first page with no data-target-link="/film/..." poster entries.
The scraper validates username format ([A-Za-z0-9_-]+) and uses retries + timeout.
Default crawl delay is 250ms/page to be polite and reduce transient failures.
This is best-effort HTML scraping; if Letterboxd changes markup, adjust the regex in the script.

Scope boundary

This skill only scrapes a public Letterboxd watchlist and writes CSV/JSONL output.
Do not read local folders, scan libraries, or perform unrelated follow-up actions unless explicitly requested by the user.

安全使用建议

This skill appears to do exactly what it says: a small Python scraper that fetches public Letterboxd watchlist pages and writes CSV/JSONL. Before installing or running it, consider: (1) Ensure your agent environment can run the script (Python 3 is required; SKILL.md references `uv run` which is not declared as a required binary). (2) Review the script yourself — it performs network requests and writes files locally but does not exfiltrate data to third parties. (3) Be mindful of scraping etiquette and Letterboxd's terms of service and rate limits: default max-pages=500 could generate many requests (the script has a 250 ms default delay and retry logic, but you may want to lower max-pages or increase delay). (4) The HTML parsing uses a regex and may break if Letterboxd changes markup; that is a reliability, not a security, concern. If you are uncomfortable running arbitrary scripts, run it in an isolated environment or review/modify the code first.

功能分析

Type: OpenClaw Skill Name: letterboxd-watchlist Version: 0.1.2 The skill's stated purpose and agent instructions are benign, explicitly limiting the agent's scope. The `scripts/scrape_watchlist.py` script properly sanitizes the username input, preventing shell injection. However, the script directly uses the user-provided `--out` file path without further sanitization or restriction. This creates an arbitrary file write vulnerability, allowing an attacker to potentially overwrite sensitive system files (e.g., `/etc/passwd`, `~/.bashrc`, `~/.ssh/authorized_keys`) with the scraped watchlist data if the OpenClaw agent does not enforce path restrictions. While this is a critical vulnerability, it does not demonstrate malicious intent by the script itself, classifying it as suspicious rather than malicious.

能力评估

ℹ Purpose & Capability

The name/description match the included code: the script scrapes a public Letterboxd watchlist and outputs CSV/JSONL. One minor inconsistency: SKILL.md shows the usage as `uv run scripts/scrape_watchlist.py` but the skill metadata lists no required binaries. The script requires a Python 3 runtime (and the agent environment needs either a way to run Python scripts or the 'uv' runner referenced).

✓ Instruction Scope

SKILL.md instructions stay on task: they instruct the agent to ask for the username, run the bundled scraper, and produce CSV/JSONL output. The docs explicitly limit scope and say not to read local folders or perform unrelated follow-ups. The scraper only fetches Letterboxd pages and writes a local output file.

✓ Install Mechanism

No install spec is provided (instruction-only plus a script file). Nothing is downloaded at install time and no archives or external installers are referenced, which is low-risk.

✓ Credentials

The skill requests no environment variables, credentials, or config paths. The script performs unauthenticated HTTP GETs to letterboxd.com only and writes a local file, which is proportionate to the stated purpose.

✓ Persistence & Privilege

The skill does not request permanent presence (always: false) and does not modify other skills or system/global config. It runs only when invoked.

版本历史

v0.1.2

Generalized skill usage for any user, tightened scope boundaries, removed personalized follow-ups, and updated docs/examples for uv-first execution.

v0.1.1

Hardened scope boundaries, removed personalized follow-ups, added generic username placeholders, and improved scraper resilience (validation, retries, polite delay).

v0.1.0

Initial release: scrape public Letterboxd watchlists to CSV/JSONL.

元数据

Slug letterboxd-watchlist

版本 0.1.2

许可证 —

累计安装 5

当前安装数 4

历史版本数 3

常见问题

Letterboxd Watchlist 是什么？

Scrape a public Letterboxd user's watchlist into a CSV/JSONL list of titles and film URLs without logging in. Use when a user asks to export, scrape, or mirror a Letterboxd watchlist, or to build watch-next queues. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1220 次。

如何安装 Letterboxd Watchlist？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install letterboxd-watchlist」即可一键安装，无需额外配置。

Letterboxd Watchlist 是免费的吗？

是的，Letterboxd Watchlist 完全免费（开源免费），可自由下载、安装和使用。

Letterboxd Watchlist 支持哪些平台？

Letterboxd Watchlist 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Letterboxd Watchlist？

由 0xnuminous（@0xnuminous）开发并维护，当前版本 v0.1.2。

Letterboxd Watchlist