Parse Dedao

解析"得到"笔记分享链接（支持提取正文和下载图片）。自动提取得到（dedao.cn）分享链接的正文内容，并支持将文章中的图片保存到本地。当用户发送得到笔记分享链接时使用此技能。

This skill appears to implement a dedao.cn scraper, but it has several red flags you should address before running: (1) run_parse.js writes output to a hard-coded Windows path (D:/notes/biji/0000) instead of the documented ./images or a configurable outputDir — change this to a relative or configurable directory to avoid overwriting files; (2) SKILL.md and test files reference parseDedao/other exports but parse.js only exports parsePage — verify and fix the API surface so you know which functions will run; (3) the skill depends on Playwright/Chromium but includes no install steps — ensure you install Playwright and its browser binaries in a controlled environment; (4) review the code locally to confirm there are no hidden network endpoints or logging to unexpected services (there are none obvious in the supplied files); (5) run the scripts in a sandbox or VM with limited permissions first to confirm behavior and to prevent accidental writes to system drives. Given the inconsistencies, treat this as potentially useful but untrusted until you fix/configure the output paths and verify dependencies.

Type: OpenClaw Skill Name: parse-deodao-shared-link Version: 1.0.1 The skill bundle exhibits high-risk behaviors including the use of hardcoded absolute Windows file paths (`D:/notes/biji/0000`) in `scripts/run_parse.js` and `scripts/test_parse.js`, which could lead to unintended file overwrites. Additionally, `scripts/parse.js` launches the browser with the `--no-sandbox` and `--disable-setuid-sandbox` flags, significantly weakening the security posture of the browser automation. While these appear to be unintentional design flaws or artifacts of a local development environment rather than intentional malware, they represent significant vulnerabilities in a shared skill bundle.