Taiji Topo File Downloader

在太极平台 a.taiji.woa.com 工作流页面自动定位节点侧边栏、打开配置文件面板并下载文件。用于“下载太极拓扑配置文件/模型文件”“在太极页面里找到文件并保存到本地”等任务，特别适合需要先校验页面是否已正确打开、再稳定定位侧边栏与文件列表的场景。

This skill appears coherent for its intended task, but before installing consider: (1) it will automate your browser to click UI elements — only run it when you trust the Taiji page and the agent's access to your browser profile; (2) the shell snippet will look in ~/Downloads and move the most-recent Chrome temporary file — if you have concurrent downloads it could pick the wrong file, so test in a controlled environment or adapt the script to use deterministic filenames; (3) there are no requested credentials, but the agent will need permission to control the browser and to run shell commands that operate on your Downloads folder; (4) if you need stronger safety, ask the maintainer for an option to preview the target temp file path before moving and to restrict operations to a dedicated download directory. Overall the skill is internally consistent and not requesting disproportionate access.

Type: OpenClaw Skill Name: taiji-topo-file-downloader Version: 1.1.0 The skill bundle automates file downloads from the internal platform 'a.taiji.woa.com' but includes high-risk shell commands in SKILL.md. Specifically, the shell script uses 'eval' and lacks sanitization for the '$file_name' variable in a 'mv' command, which presents a path traversal vulnerability. While the behavior appears aligned with its stated purpose, the use of shell execution to manipulate local files in '~/Downloads' without robust input validation is a significant security risk.