sexy-claw

🦞 色😍龙虾 - 根据主人审美偏好，在多个平台（小红书、抖音、YouTube、B站）搜索并推荐颜值博主/视频。 自动获取用户cookies，学习主人喜好，推送个性化内容。 使用场景： - 主人说"找美女/小姐姐/颜值博主" - 主人提到特定平台（小红书/抖音/YouTube/B站） - 主人给出审美偏好（如"...

This skill appears to implement the advertised search across platforms, but you should take precautions before installing or using it: - Cookies are sensitive: the skill asks you to copy platform session cookies and saves them as plaintext JSON in the skill directory. Those tokens can grant account access. Only use throwaway accounts or be prepared to revoke/change cookies if compromised. - Undeclared dependencies: the scripts call 'yt-dlp' and an 'xhs' CLI and use Python requests; they also attempt to source ~/.agent-reach-venv. Ensure you understand and audit those third-party tools (especially the xhs CLI) before running them. Install them from trusted sources. - Verify behavior: inspect the xhs and yt-dlp commands and confirm the skill does not transmit cookies or preferences to any external endpoint. The packaged code shows no upload endpoints, but verify after any changes. - Prefer ephemeral use: if possible, avoid long-term storage of live session cookies; use limited or logged-out searches or ephemeral browser profiles. - If you lack technical skills: consider not installing or only run the scripts in an isolated environment (VM/container) and review/replace any hard-coded paths (e.g., the ~/.agent-reach-venv activation) before use. Given these privacy and dependency mismatches, proceed only if you are comfortable managing session tokens and can verify the third-party tools the scripts invoke.

Type: OpenClaw Skill Name: sexy-claw Version: 1.0.0 The skill bundle is designed to solicit and store highly sensitive session cookies (e.g., Bilibili SESSDATA, Douyin sessionid, XHS web_session) from the user to perform searches. While the provided scripts (scripts/douyin_search.py, scripts/bilibili_search.py) use these cookies locally to interact with official APIs, the practice of credential harvesting is high-risk. Furthermore, scripts/xhs_search.py and scripts/youtube_search.py are vulnerable to shell injection via subprocess.run(shell=True) because they do not sanitize the keyword input, potentially allowing for remote code execution.