← 返回 Skills 市场

小雅影音下载器

Name: 小雅影音下载器
Author: hanshojin

作者 HANSHOJIN · GitHub ↗ · v1.2.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install xiaoya-download

功能描述

搜索并从小雅 Alist 下载电影/剧集到本地目录。输入电影或剧集名称，通过小雅搜索接口查找，选择结果后下载到本地。

使用说明 (SKILL.md)

🎬 XiaoyaDownload — 小雅影音下载器

搜索小雅/Alist 中的电影/剧集，通过本地 WebDAV 挂载复制到 NAS 指定目录。

功能

搜索全库 — 输入电影/剧集名称，直接搜索小雅全库资源
版本选择 — 显示多个版本（不同画质、大小、格式），你可以挑选
WebDAV 复制 — NAS 挂载了小雅 WebDAV 时，用 rsync 本地高速复制

使用方式

搜索电影/剧集

"搜索肖申克的救赎" "帮我找找盗梦空间"

选择要下载的版本

搜索后列出所有版本，告诉小虾编号：

"下载第1个"

操作示例

你: 搜索肖申克的救赎

🦐: 🔍 正在搜索「肖申克的救赎」...
    找到 55 个结果：
    
    [ 1] 🎬 【1994】【肖申克的救赎】.mkv
    [ 6] 🎬 肖申克的救赎 ... 1080p.x265.mkv (11.8 GB)
    ...
    
    要下载哪个？(输入编号)

你: 6

🦐: 📁 复制文件: /vol02/.../肖申克的救赎...mkv → /vol1/1000/Video/
    rsync 速度: 39 MB/s
    ✅ 复制完成！

环境配置

创建 .env 文件：

# 小雅/Alist 网页地址（必填）
XIAOYA_HOST=http://192.168.50.1:5678

# 下载保存目录（必填）
DOWNLOAD_DIR=/vol1/1000/Video

# WebDAV 本地挂载路径（推荐）
WEBDAV_MOUNT=/vol02/1000-1-3fe2c39a

CLI 命令

# 配置检查
python3 scripts/xiaoya_download.py setup

# 搜索
python3 scripts/xiaoya_download.py search "肖申克的救赎"

# 复制到本地（WebDAV）
python3 scripts/xiaoya_download.py copy "/电影/IMDB Top 250/200-250/肖申克的救赎...mkv"

文件结构

skills/XiaoyaDownload/
├── SKILL.md
├── scripts/
│   └── xiaoya_download.py
├── .env
├── .env.example
└── _meta.json

安全使用建议

Only use this skill with a trusted Xiaoya/Alist host and review the exact source and destination before copying. Configure WEBDAV_MOUNT and DOWNLOAD_DIR carefully, avoid paths containing ../, and prefer an updated version that validates paths stay inside the WebDAV mount before running rsync.

功能分析

Type: OpenClaw Skill Name: xiaoya-download Version: 1.2.0 The skill implements a media downloader using `rsync` in `scripts/xiaoya_download.py`. It contains a path traversal vulnerability in the `cmd_copy` function because `urllib.parse.unquote` is applied to the `remote_path` after it has been joined with the root directory, potentially allowing an attacker to access files outside the intended `WEBDAV_MOUNT` directory. While the functionality aligns with the stated purpose of downloading media, the use of system-level copy commands with unsanitized user-controlled paths constitutes a high-risk vulnerability.

能力评估

ℹ Purpose & Capability

The advertised purpose and implementation are generally coherent: it searches a configured Xiaoya/Alist host and copies selected media from a local WebDAV mount into a configured download directory. Users should expect network access, local file reads/writes, and rsync use.

⚠ Instruction Scope

The copy workflow accepts a remote path and runs rsync after only stripping a leading slash and URL-decoding it. There is no normalization or containment check to ensure the resolved path remains under WEBDAV_MOUNT, and no clear overwrite confirmation.

ℹ Install Mechanism

The registry says there is no install spec and no required binaries/env vars, but the script needs Python requests, rsync, and .env configuration. This is purpose-aligned but under-declared.

⚠ Credentials

Reading from a WebDAV mount and writing to DOWNLOAD_DIR is proportionate for a downloader, but the unvalidated path construction can escape the intended mount boundary if given traversal segments such as ../ or encoded equivalents.

✓ Persistence & Privilege

No background service, autonomous persistence, credential storage, or privilege escalation is shown. It only reads a user-created .env file for configuration.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install xiaoya-download
安装完成后，直接呼叫该 Skill 的名称或使用 /xiaoya-download 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.2.0

v1.2.0: 搜索结果显示表格，带画质/编码/大小信息；移除API依赖；支持WebDAV复制

v1.1.1

v1.1.1: 清理文档，移除Token相关说明，仅依赖网页搜索+WebDAV

v1.1.0

v1.1.0: 移除API依赖，仅保留网页搜索+WebDAV复制，配置更简单

v1.0.0

首个版本：搜索小雅全库电影/剧集，支持WebDAV本地复制和API直链下载

元数据

Slug xiaoya-download

版本 1.2.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 4

常见问题