scut-review-monitor

Check or monitor the SCUT thesis blind-review status page through the graduate portal and refresh cookies through a local Python helper.

This skill appears to do what it says (open the SCUT portal, check an XPath, save cookies, optionally monitor), but inspect and edit config.json before use. Important points: - The script saves cookies and login QR images locally (cookies.json, login_qrcode.png, login_qrcode.txt) — these are sensitive. - By default the config enables image uploading; that will send the QR code to the configured api_url. Disable image_upload.enabled or set api_url to a trusted service if you do not want QR images sent externally. - Notification endpoints (notify.notify_url, serverchan_sendkey) can receive status text; only configure endpoints you trust and avoid placing secrets in public copies of config.json. - The script may auto-install Playwright Chromium (runs 'python -m playwright install chromium'); review this if installing binaries automatically is undesirable. - If you plan to run continuous monitoring, run the script under your own supervisor (systemd/cron) rather than asking the skill to daemonize it. If you want higher assurance, run the tool in an isolated environment (VM/container) after editing config.json to disable uploads, or manually audit/modify portal_monitor.py to remove external uploads/notifications before running.

Type: OpenClaw Skill Name: scut-review-monitor Version: 1.0.3 The skill monitors a university portal using Playwright to automate logins and scrape status updates. It is classified as suspicious because it extracts authentication QR codes and uploads them to a third-party image hosting service (https://img.scdn.io/api/v1.php) by default, which poses a high risk of credential interception. Additionally, it saves session cookies locally and sends data to external notification endpoints (portal_monitor.py, config.json), which are risky behaviors despite being documented as features for user convenience.