中文 EN
Start Review
Skill Trust Decision

skroller

合法的社交媒体内容收集工具，代码结构清晰，无恶意行为证据，存在轻微供应链风险（依赖无版本锁定）。

Install decision first Source: ClawHub Scanned: Apr 6, 2026
Files 9
Artifacts 51
Violations 0
Findings 3

Why this conclusion was reached

0/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review
Hidden execution and egress

51 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Pass
Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

What drove the risk score up

依赖无版本锁定 +15

package.json 中 playwright 使用 ^1.40.0 语义化版本，可能安装不兼容更新

外部网络请求 +5

脚本需访问多个社交媒体平台，属于声明范围内的合法操作

平台ToS合规风险 +5

SKILL.md 提及合规要求，但爬虫行为本身可能触发平台反爬机制

Most important evidence

Low Supply Chain

依赖版本未精确锁定

playwright 使用 ^1.40.0 语义化版本控制，可能自动安装不兼容的更新版本

package.json:18
改为精确版本或锁定次版本：如 "playwright": "1.40.0" 或 "~1.40.0"
Low Doc Mismatch

shell执行能力未在文档声明

export-to-notes.js 使用 execSync 执行 shell 命令（用于 Bear 导出调用 grizzly CLI），但 SKILL.md 中未声明 shell 权限需求

scripts/export-to-notes.js:323
在 SKILL.md 中声明需要 shell:WRITE 权限用于调用 grizzly CLI
Info Sensitive Access

AppleScript 执行涉及系统交互

Apple Notes 导出通过 osascript 执行 AppleScript，可能触发系统权限提示

scripts/export-to-notes.js:357
这是 macOS 笔记应用导出的标准方式，属于合法用途

Declared capability vs actual capability

Filesystem Pass
Declared WRITE
→
Inferred WRITE
scripts/skroller.js:234 fs.writeFileSync(output, content)
Network Pass
Declared READ
→
Inferred READ
scripts/skroller.js:166 await page.goto(url)
Shell Pass
Declared NONE
→
Inferred WRITE
scripts/export-to-notes.js:323 execSync(command, { stdio: 'inherit' })

Suspicious artifacts and egress

Medium External URL
https://twitter.com/...

SKILL.md:215

Medium External URL
https://www.reddit.com/search.json?q=test

assets/selector-reference.md:84

Medium External URL
https://news.ycombinator.com/search?query=test

assets/selector-reference.md:315

Medium External URL
https://twitter.com/

references/platform-details.md:20

Medium External URL
https://twitter.com/search?q=

references/platform-details.md:21

Medium External URL
https://twitter.com/search?q=%23

references/platform-details.md:22

Medium External URL
https://www.reddit.com/search/?q=

references/platform-details.md:51

Medium External URL
https://www.reddit.com/r/

references/platform-details.md:52

Medium External URL
https://www.reddit.com/user/

references/platform-details.md:53

Medium External URL
https://oauth.reddit.com

references/platform-details.md:65

Medium External URL
https://www.reddit.com/

references/platform-details.md:66

Medium External URL
https://oauth.reddit.com/search.json?q=$

references/platform-details.md:73

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
playwright ^1.40.0 npm No 使用语义化版本，建议锁定精确版本

File composition

9 files · 2491 lines
Markdown 4 files · 1293 linesJavaScript 3 files · 1135 linesJSON 2 files · 63 lines
Files of concern · 6
scripts/export-to-notes.js JavaScript · 655 lines
shell执行能力未在文档声明 · AppleScript 执行涉及系统交互 · https://api.notion.com/v1/pages · http://xml.evernote.com/pub/evernote-export4.dtd · https://graph.microsoft.com/v1.0/me/onenote/sections/$ · https://graph.microsoft.com/v1.0/me/onenote/pages · https://keep.google.com
scripts/skroller.js JavaScript · 309 lines
https://twitter.com/$ · https://twitter.com/search?q=$ · https://www.reddit.com/search/?q=$ · https://www.instagram.com/$ · https://www.instagram.com/explore/tags/$ · https://www.tiktok.com/search?q=$ · https://www.linkedin.com/search/results/content/?keywords=$ · https://www.youtube.com/results?search_query=$ · https://www.producthunt.com/search?q=$ · https://medium.com/search?q=$ · https://www.pinterest.com/search/pins/?q=$
SKILL.md Markdown · 307 lines
https://twitter.com/...
references/platform-details.md Markdown · 350 lines
https://twitter.com/ · https://twitter.com/search?q= · https://twitter.com/search?q=%23 · https://www.reddit.com/search/?q= · https://www.reddit.com/r/ · https://www.reddit.com/user/ · https://oauth.reddit.com · https://www.reddit.com/ · https://oauth.reddit.com/search.json?q=$ · https://www.instagram.com/ · https://www.instagram.com/explore/tags/ · https://www.instagram.com/reels/ · https://www.tiktok.com/search?q= · https://www.tiktok.com/@ · https://www.tiktok.com/tag/ · https://www.linkedin.com/search/results/content/?keywords= · https://www.linkedin.com/in/ · https://www.linkedin.com/company/ · https://www.youtube.com/results?search_query= · https://www.youtube.com/@ · https://www.youtube.com/watch?v= · https://news.ycombinator.com/search?query= · https://news.ycombinator.com/ · https://news.ycombinator.com/newest · https://www.producthunt.com/search?q= · https://www.producthunt.com/topics/ · https://www.producthunt.com/leaderboard · https://medium.com/search?q= · https://medium.com/ · https://medium.com/@ · https://www.pinterest.com/search/pins/?q= · https://www.pinterest.com/
assets/selector-reference.md Markdown · 414 lines
https://www.reddit.com/search.json?q=test · https://news.ycombinator.com/search?query=test
package.json JSON · 26 lines
依赖版本未精确锁定
Other files · rate-limits.md · feed-digest.js · .skroller-config.example.json

Security positives

代码结构清晰，注释完整，包含合规声明
无 base64 编码或混淆代码
无凭证收割、环境变量遍历或敏感路径访问
无外部 IP 或 C2 通信
所有网络请求指向合法社交媒体平台
支持 dry-run 模式，可预览操作
支持多平台笔记应用导出，功能透明