← 返回 Skills 市场
393
总下载
0
收藏
1
当前安装
17
版本数
在 OpenClaw 中安装
/install weread-import
功能描述
Export WeRead highlights and notes into Markdown files, usually into an Obsidian Reading folder. Use when the user asks to import or sync WeRead books, re-re...
安全使用建议
This repository is coherent with its stated purpose, but please consider the following before installing or running: 1) The first run triggers `npm install --production` which will download 'playwright' and its browser artifacts — run this only on systems where you trust package installs or in an isolated environment. 2) The tool extracts WeRead cookies either from a provided cookie string or by connecting to a local Chrome CDP (127.0.0.1:9222). If you enable the legacy profile-sync mode (WEREAD_PROFILE_SYNC_MODE=legacy) the script will copy Chrome profile files (including Login Data) into the managed profile — avoid legacy mode unless you understand and accept that it accesses broader browser authentication artifacts. 3) To minimize risk, run initial tests with output directed to a temporary directory (e.g., /tmp/...) and use the provided scripts/prepare-staging-skill.sh to verify in a staging directory. 4) Inspect scripts/run.sh and scripts/open-chrome-debug.sh and, if unsure, run the tool inside a disposable VM/container. 5) If you want stronger assurance, review the code paths that call chromium.connectOverCDP and the cookie extraction functions; the network endpoints contacted are only weread.qq.com. If you want me to point to exact lines that copy profile files or perform cookie extraction, I can highlight them.
功能分析
Type: OpenClaw Skill
Name: weread-import
Version: 0.3.9
The skill bundle contains high-risk functionality in `scripts/open-chrome-debug.sh` that can synchronize sensitive browser data. Specifically, the script includes logic to copy Chrome profile files, including `Cookies` and `Login Data` (which stores saved passwords), from the user's default Google Chrome directory to a local profile folder. While this behavior is intended to facilitate authentication for WeRead and is disabled by default (requiring `WEREAD_PROFILE_SYNC_MODE=legacy`), the capability to duplicate browser credentials and session tokens is a significant security risk. The rest of the code in `src/` and `scripts/run.sh` appears consistent with the stated purpose of exporting reading notes to Markdown.
能力评估
Purpose & Capability
Name/description describe exporting WeRead highlights to Markdown; the repository contains a CLI, API calls to weread.qq.com, cookie extraction, rendering, merge/state management and file-writing. Required runtime items (Node, Playwright, optional access to Chrome CDP and an output directory) are coherent with that purpose.
Instruction Scope
SKILL.md directs the agent to run scripts/run.sh which: installs npm deps on first run, may launch or connect to Chrome via CDP and extract weread.qq.com cookies, write Markdown files to a user-provided output directory, and create a managed browser profile under ~/.weread-import-profile-isolated by default. These actions are expected for the tool, but they include reading browser cookies and optionally accessing Chrome profile files (see profile sync 'legacy' mode) — a privacy-sensitive operation the user must opt into.
Install Mechanism
There is no registry install spec; scripts/run.sh runs npm install --production in the repo on first run. package.json depends on 'playwright', which will be downloaded from the npm registry and (via Playwright's normal postinstall) may also fetch browser binaries. This is a standard but non-trivial network install that writes to disk and executes package install scripts — moderate risk compared to instruction-only skills.
Credentials
No unrelated cloud credentials are requested. The tool legitimately needs either a weread cookie (WEREAD_COOKIE or --cookie) or access to a local Chrome CDP to extract cookies. The env vars documented (WEREAD_COOKIE, WEREAD_CDP_URL, WEREAD_OUTPUT, etc.) match the functionality. Only caveat: legacy profile-sync mode will copy Chrome 'Login Data' and related files from the default Chrome profile into a managed profile — this grants access to broader browser auth artifacts and should be avoided unless intentionally required.
Persistence & Privilege
always:false (no forced always-on). The skill writes state files in the chosen output directory (.weread-import-state.json) and creates/uses a local managed browser profile under the user's home directory. It does not request persistent system-wide privileges or modify other skills. Still, it spawns Chrome and creates local files, so run it with care and choose an output/profile path you control.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install weread-import - 安装完成后，直接呼叫该 Skill 的名称或使用
/weread-import触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.3.9
- Added new script: scripts/wait-browser-managed-ready.mjs
- This script supports readiness checks or coordination for the managed browser mode.
v0.3.8
No changes detected in this version.
- No file changes were detected from the previous release.
- Functionality and documentation remain unchanged.
v0.3.7
weread-import 0.3.7
- No file changes detected in this version.
- Documentation and usage instructions remain consistent with previous release.
v0.3.6
**Major update: Added browser session/management refactor and new test/utility scripts.**
- Introduced new browser session management modes: `browser-live` and `browser-managed`, with detailed usage distinction in documentation.
- Added session handling and browser management logic (`src/browser-mode.mjs`, `src/session.mjs`).
- Updated CLI parameters to support new cookie/browser handling options.
- Included staging preparation script (`scripts/prepare-staging-skill.sh`) and corresponding tests.
- Added automated tests for new functionality: browser mode and session management.
- Improved documentation reflecting new modes, correct usage, and environment requirements.
v0.3.5
- Added initial test file: tests/api.test.mjs
- Introduced basic testing infrastructure for API validation
v0.3.4
- No file changes detected in this release.
- No user-facing changes or updates.
v0.3.3
- WeRead sync tasks no longer stay alive after cookie extraction or auth failure due to leaked CDP connections
- --cookie-from browser is less likely to report false cookie expiration when the managed Chrome profile snapshot is stale
v0.3.2
- sort highlights and reviews by chapter order using live API chapter indexes
- sort highlights and reviews within a chapter by range position instead of create time when available
- preserve chapterIdx and range metadata in markdown so deleted archives can keep a stable sort order
- keep deleted chapters separated by chapterUid even when chapter names collide
- fix browser cookie extraction to include all cookies applicable to weread.qq.com, including host-only cookies like wr_gid
v0.3.1
weread-import 0.3.1
Changes
- fix highlight ordering within a chapter by sorting parsed bookmarkId positions before falling back to createTime
- support legacy bookmarkId values that only contain a single position number
v0.3.0
- Removed DOM mode support and related files; only API mode is now supported.
- Updated documentation to reflect the exclusive use of API mode for all import and sync actions.
- Added strict instructions and exit code handling for scheduled or automated runs, forbidding workaround parameters and automation pitfalls.
- Simplified available parameters, removing DOM-related options.
- Refined usage notes to clarify browser login and cookie refresh expectations.
v0.2.5
- Added environment example file: env.example.md.
- Introduced initial DOM extraction test: tests/dom.test.mjs.
- Updated documentation with more robust details on cookie handling and DOM mode verification.
- Clarified behaviors in auto and dom mode error fallback scenarios.
- Updated references to environment variable documentation filename (env.example.md).
v0.2.4
fix: resolve -2012 auth errors, add cache-busting, auto fallback to DOM, auto-start Chrome CDP
v0.2.3
no changes re-upload after clawhub update
v0.2.2
添加 CLAUDE.md 项目约定文档、文案润色
v0.2.1
Use bundled runtime and document bash run invocation
v0.2.0
Self-contained skill candidate with bundled CLI and local runtime setup
v0.1.0
Initial public release
元数据
常见问题
WeRead Import 是什么？
Export WeRead highlights and notes into Markdown files, usually into an Obsidian Reading folder. Use when the user asks to import or sync WeRead books, re-re... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 393 次。
如何安装 WeRead Import？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install weread-import」即可一键安装，无需额外配置。
WeRead Import 是免费的吗？
是的，WeRead Import 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
WeRead Import 支持哪些平台？
WeRead Import 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 WeRead Import？
由 GNIXNER（@gnixner）开发并维护，当前版本 v0.3.9。
推荐 Skills