social-media-analysis

社交媒体舆情数据分析工具。从飞书多维表格读取 URL，下载媒体，分析内容，生成摘要。

This skill appears to do what it says (read Feishu bitable, download social-media media, extract frames, and generate short analyses), but it has several practical and security gaps: (1) The registry metadata does not declare the environment variables and command-line tools the scripts actually use — APP_ID, APP_SECRET, BITABLE_URL, optional XHS_COOKIE, and binaries like node, yt-dlp, ffmpeg, and Playwright are required at runtime. (2) Although permissions list only open.feishu.cn, the scripts make many outbound requests to social-media domains and will download files to disk. Before installing, verify you trust the source and review the full scripts locally. Prefer running in an isolated environment (dedicated VM/container) and use a Feishu app with minimal scope (rotate/revoke credentials after testing). If you need tighter control, request the publisher to update registry metadata to list required env vars, required binaries, and all outbound hosts, and to explain the unspecified 'image' analysis step and any external model endpoints it may call.

Type: OpenClaw Skill Name: social-media-analysis Version: 1.0.0 The skill contains critical shell injection vulnerabilities in scripts/parse-bilibili.js and scripts/parse-xiaohongshu.js, where unsanitized URLs retrieved from a Feishu Bitable are passed directly to execSync calls for yt-dlp. While these flaws allow for potential Remote Code Execution (RCE), they appear to be unintentional coding errors rather than intentional malware. Additionally, the SKILL.md file declares restricted network permissions (only open.feishu.cn) that do not align with the scripts' actual behavior of accessing multiple social media domains like douyin.com, weibo.cn, and xiaohongshu.com.