Sentiment Radar

Multi-platform sentiment monitoring and analysis for products/brands/topics. Collect public opinions from Chinese platforms (小红书/XHS via MediaCrawler) and En...

This skill appears to do what it says (scrape XHS/Douyin and analyze comments), but it expects local tools and credentials that are not declared in the registry metadata. Before installing or running: - Understand that the crawler runs in CDP mode against your Chrome browser (localhost:9222) and may access browser session data — consider using a dedicated browser profile or a disposable VM/container. - The workflow expects an Xpoz/mcporter tokens.json file for Twitter/Reddit access and a MediaCrawler repo in a local path; these are sensitive credentials/files—verify their presence and contents and avoid pointing the skill at production credentials you care about. - Review the referenced third-party repo (https://github.com/NanmiCoder/MediaCrawler) yourself to confirm behavior and safety before cloning and running. - The analyze script includes IP-location and comment excerpts in reports; ensure you are permitted to process and share any PII that may appear. - If you want to proceed, run the tooling in an isolated environment (VM/container) and avoid reusing your main browser profile for CDP scraping. If you need, provide the repo URLs and the content of any external token files and I can help you inspect them for risky behavior.

Type: OpenClaw Skill Name: sentiment-radar Version: 1.0.0 This skill is classified as suspicious due to its reliance on external, user-installed code from GitHub (`MediaCrawler` in `SKILL.md` and `xhs_crawler.py`), which introduces supply chain risks. It also utilizes powerful capabilities such as `exec(background=true)` for background process execution (SKILL.md), programmatic modification of another skill's configuration file (`base_config.py` in `xhs_crawler.py`), and direct browser automation via Chrome DevTools Protocol (`connect_over_cdp` in `dy_scrape.py`). While these actions are plausible for a web scraping and analysis tool, they represent high-privilege operations that could be exploited or misused if the external dependencies were compromised or if the agent were prompted to deviate from its intended purpose. There is no clear evidence of intentional malicious behavior like data exfiltration to external endpoints or persistence mechanisms.