NowPlaying XHS

当前院线推荐 - 实时检索公映影片 + 多维度评分 + 附近影院排片

This package has inconsistent documentation vs code. Before installing or supplying credentials: (1) Ask the author to clarify and update the registry metadata to declare required env vars (BOCHA_API_KEY, TAVILY_API_KEY) and any binaries (agent-browser, node). (2) Confirm whether the skill will actually call Bocha/Tavily/猫眼/淘票票 and whether you must install agent-browser globally (npm install -g) — global npm installs modify your system. (3) If you must provide API keys, only provide scoped keys with minimal permissions and rotate them if you later uninstall. (4) Be aware SKILL.md instructs accessing user location and starting a local HTTP server/screenshot flow; ensure you trust the skill and understand where data (including location) will be sent. (5) If you only want the functionality implemented by the included nowplaying.py (Rotten Tomatoes/Variety scraping), prefer running that script in an isolated environment; if you need the Chinese real-time functionality, request a code update that implements it and explicitly declares required env vars and install steps. If the author cannot reconcile these mismatches, treat the skill as untrusted.

Type: OpenClaw Skill Name: nowplaying-xhs Version: 1.1.0 The skill bundle contains high-risk instructions in SKILL.md that direct the AI agent to execute shell commands, install global NPM packages, and launch a background HTTP server (python3 -m http.server) on the host. While these actions are intended to facilitate chart rendering via browser screenshots, they introduce significant security risks such as unauthorized local network exposure and arbitrary command execution. The Python script (nowplaying.py) is a benign scraper, but the operational instructions for the agent involve excessive system-level permissions.