下载电影/电视剧/综艺的剧照/海报

Name/description match the implementation: Node.js scripts that search Douban, extract photo IDs (optionally with Playwright), and download images while handling Referer and redirects. Required binaries (node, npm) and the playwright dependency are coherent with the stated scraping/downloading functionality.

SKILL.md and the JS files instruct the agent to run the included Node scripts and save files under the user's home directory. The code only accesses network resources (Douban and image hosts) and local filesystem directories under the user's home. Minor inconsistency: SKILL.md claims 'does not connect to existing browser sessions for privacy', while some comments and examples in code mention inheriting or connecting to an existing browser session or remote-debugging; actual Playwright functions in the code launch a new headless browser. This is a documentation/code mismatch but not an obvious malicious behavior.

Install uses the well-known npm package 'playwright' (expected for headless browser scraping). Playwright will typically download browser binaries during install which increases disk usage and performs network downloads — expected for this use-case but worth noting as extra installation footprint.

The skill requests no environment variables or credentials and does not access configs outside its download directory. It only uses the network to contact Douban and image host domains, which is proportional to its stated purpose.

always:false and no special privileges requested. The skill writes files only under the user's home (.openclaw/output/photo-download or ~/download/photos) and does not attempt to modify other skills or system-wide settings.