每日潜力网文新书推荐-SBTI版！

起点中文网好书推荐，支持两种模式： 1）三江榜新书推荐——每天从起点三江榜单中精选3本优质新书； 2）经典网文推荐——从起点万订/十万均订经典作品中随机推荐，附IP衍生品（电视剧/动漫/手办）和海外出圈信息。 内置去重机制，支持按 SBTI 性格筛选。 触发场景：推荐好书、三江榜、起点推荐、小说推荐、今天看什么书...

This skill appears to implement what it claims (Qidian recommendations via two Python scripts) and requires no credentials, but exercise caution before running it. Steps to reduce risk: 1) Inspect the raw SKILL.md and the two Python scripts yourself (they are included) — look for hidden/obfuscated strings or unexpected network endpoints. 2) Because the scripts auto-install pip packages, run them in an isolated environment (container/VM) or disable network/PyPI access and preinstall required deps (beautifulsoup4, lxml). 3) Run with --setup first to observe behavior and network calls; do not run as root. 4) If you won’t use Excel import or refresh features, avoid those commands to limit file reads/remote requests. 5) Be aware the skill enforces keeping a _trace parameter in outbound qidian.com links (a tracking/attribution requirement); if you’re uncomfortable with attribution/tracking, remove or modify links after reviewing implications. 6) The presence of unicode-control-chars in SKILL.md is unusual — if you lack confidence, ask the publisher for clarification or avoid installing until the SKILL.md is sanitized. Overall: functionally coherent but has prompt-injection signals and runtime pip installs — review manually and sandbox execution.

Type: OpenClaw Skill Name: qidiandayrec Version: 1.0.5 The skill bundle is a legitimate tool for recommending web novels from Qidian, featuring a humorous 'SBTI' personality-based filtering system. The Python scripts (classic_picker.py and sanjiang_picker.py) are well-structured scrapers that fetch book data from qidiantu.com and manage local caches and history to ensure variety in recommendations. While the scripts include a self-installation mechanism for dependencies (beautifulsoup4, lxml, openpyxl) using subprocess, this behavior is transparently documented and aligned with the stated purpose of setting up the environment. The instructions in SKILL.md regarding the preservation of URL tracking parameters (_trace) are standard for attribution and do not represent a malicious prompt injection. No evidence of data exfiltration, unauthorized execution, or persistence was found.