Real Estate Crawler

综合房产中介网站爬虫技能，支持安居客、贝壳找房、链家、搜房网的数据抓取，包含反爬虫绕过策略和数据提取功能。

This skill appears to be what it claims — a set of crawlers and agent-browser scripts that intentionally attempt to bypass anti‑bot defenses. Before installing or running it, consider: 1) Legal/ToS risk — bypassing anti‑bot measures or scraping protected content can violate website terms or local law; only use for authorized/legal purposes. 2) Privacy/exfiltration risk — the code saves session cookies/screenshots and contains examples that would send CAPTCHA images to external APIs if you configure them; do not add third‑party API keys unless you trust the service. 3) Trust and isolation — run in an isolated environment (container/VM) and review/clean the proxy list and any configured endpoints. 4) Credentials — the tool does not require secrets by default, but if you add API keys or session cookies they grant access to site sessions; store them securely and minimally. 5) Audit before use — inspect any proxy URLs and any captcha‑solver endpoints you plan to use. If you need a safer alternative, prefer official APIs or licensed data providers rather than bypassing site protections.

Type: OpenClaw Skill Name: real-estate-crawler Version: 1.0.0 The skill bundle contains a critical security vulnerability in 'main.py', where user-provided command-line arguments are concatenated into shell strings and executed via 'subprocess.run(shell=True)', creating a high risk of Remote Code Execution (RCE) through shell injection. While the bundle provides extensive tools and documentation for bypassing anti-crawler mechanisms on Chinese real estate websites (e.g., 'scripts/bypass_ke.sh', 'docs/anti_crawler_guide.md'), its behavior appears aligned with its stated purpose of data collection. There is no evidence of intentional malice, such as credential theft or unauthorized data exfiltration, but the lack of input sanitization in the execution logic warrants a suspicious classification.