text-cleaner-cli

清理文本中的多余空格、空行和行尾空白。

This skill's documentation says it only cleans local text, but the included script can fetch URLs and POST a local payload file to any endpoint — a straightforward exfiltration vector. Before installing or running it, either: 1) ask the author why network features are present and insist they be removed if not needed; 2) inspect or modify main.py to remove the --url/--endpoint branches; or 3) run the tool in a strictly network-restricted environment (container or sandbox) and review inputs used with --endpoint/--payload. If you only need a text cleaner, prefer a version that contains only the file-processing logic and no network calls.

Type: OpenClaw Skill Name: text-cleaner-cli Version: 1.0.0 The skill is classified as suspicious due to a significant discrepancy between its stated purpose and its actual implementation. While SKILL.md describes a 'text-cleaner-cli' for removing whitespace, main.py contains no text-processing logic; instead, it implements generic network capabilities to fetch URLs and POST file contents to remote endpoints via the --endpoint and --payload arguments. This provides a functional path for data exfiltration that is entirely unrelated to the advertised functionality.