media-cluster

Automatically crawls Chinese social media by keyword, summarizes content, generates a markdown report, and produces a short voice summary using TTS.

This skill mostly does what it says (clones a MediaCrawler repo, runs crawls, summarizes, and optionally calls SenseAudio for TTS), but you should be careful before installing/running it: 1) Metadata is incomplete — the skill requires Conda, Node.js for some platforms, and an API key SENSEAUDIO_API_KEY for TTS, but those are not declared in the registry entry; ask the author to correct the metadata. 2) The skill clones and executes a third‑party GitHub repository at runtime — review that repository's code yourself (or run inside an isolated VM/container) before allowing it to run on any machine with sensitive data. 3) Running crawlers may require logging into target apps (QR scan) and may store login state; consider privacy and terms‑of‑service/legal issues for scraping. 4) If you only need summarization/TTS of user-supplied content, consider using an approach that does not run a remote crawler. 5) If you proceed, run the skill in an isolated environment (container/VM) and provide a SenseAudio API key only if you trust the TTS provider; revoke keys if you suspect misuse.

Type: OpenClaw Skill Name: media-cluster Version: 1.0.1 The skill bundle automates social media crawling and summary generation by cloning the external 'MediaCrawler' repository and executing its code via shell scripts (ensure_mediacrawler.sh, setup_env.sh), which introduces a significant supply chain and RCE risk. The SKILL.md file contains instructions for the agent to automatically execute a multi-step workflow—including environment setup, third-party code execution, and API interaction—upon a single user prompt, which increases the potential impact of prompt injection. While these capabilities (shell access, network calls to https://api.senseaudio.cn, and file system operations) are aligned with the stated purpose, the reliance on unpinned external artifacts and automated high-privilege execution steps warrants a suspicious classification.