Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
秒秒AI助理
v1.0.0调用秒秒AI多能力智能体,支持聊天、天气、新闻、快递、图像生成、搜索、总结、图表、地图、车票查询等功能。Invoke when user needs AI assistant with multiple practical functions or mentions related keywords.
⭐ 0· 223·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code (miaomiao_client.py) implements a client that POSTs to an LLM-like API (api.link-ai.tech) and provides the multi-capability features listed in SKILL.md/README (chat, weather, images, search, etc.). That functionality is coherent with the skill's name and description. However, branding and environment-var names are inconsistent across files (LINKAI_* vs MIAOMIAO_*), and the registry metadata lists no required env vars even though the code requires credentials.
Instruction Scope
SKILL.md/README instructs creating a .env and setting LINKAI_APP_CODE and LINKAI_API_KEY (or in SKILL.md it only mentions LINKAI_API_KEY), while the actual SDK expects MIAOMIAO_APP_CODE and MIAOMIAO_API_KEY (and will raise if app_code or api_key are missing). This mismatch means the runtime instructions do not reliably reflect what the code will read; the instructions themselves do not attempt to access unrelated system files, but their inaccuracies are a scope/confusion risk.
Install Mechanism
There is no install spec in the registry (instruction-only skill with bundled Python files). The README asks the user to pip install python-dotenv, which is reasonable. No downloads from untrusted URLs or archive extraction are present.
Credentials
The registry metadata claims no required environment variables, but the runtime SDK requires an API key (MIAOMIAO_API_KEY) and an app code (MIAOMIAO_APP_CODE, defaulting to 'ZQmQHAXf'). Documentation alternately references LINKAI_* names. This inconsistency is disproportionate to the stated metadata and could lead to accidental use of the wrong credential names or accidental exposure of real credentials. The client sends an Authorization: Bearer <api_key> to api.link-ai.tech — expected, but users should be aware network requests include that secret.
Persistence & Privilege
The skill is not always-enabled; it is user-invocable and allows autonomous invocation (platform default). It does not request any system-wide config paths or attempt to persist or modify other skills. No elevated persistence is requested.
What to consider before installing
What you should check before installing or using this skill:
- Environment variables: The documentation (SKILL.md/README) and the code disagree. The SDK expects MIAOMIAO_APP_CODE and MIAOMIAO_API_KEY, but examples/docs show LINKAI_APP_CODE and LINKAI_API_KEY. Confirm which names you must set in your .env and set both names if unsure (or inspect miaomiao_client.py). If you don't set the expected vars the client will raise an error.
- Credentials and scope: The client will send Authorization: Bearer <API_KEY> to api.link-ai.tech (or another host if you override MIAOMIAO_API_URL). Only use an API key that is scoped for this service; do not reuse high-privilege or long-lived credentials you care about.
- Endpoint sanity: By default api_url is api.link-ai.tech. If you plan to change MIAOMIAO_API_URL, be careful — pointing it to an arbitrary host would send your API key there. Do not set that to unknown or untrusted servers.
- Functional testing: Run the examples in an isolated/test environment first (use a test API key or rate-limited account). Confirm behavior matches expectations and that the skill does not try to read other local secrets.
- Ask for clarification or fix: The mismatched env var names and branding (Link‑AI vs MiaoMiao/秒秒) looks like a packaging/documentation error. Consider asking the maintainer to fix SKILL.md/README and registry metadata to explicitly declare required env vars and their names.
- If you are risk-averse: do not provide production API keys until you confirm which env vars the code reads and that the endpoint is legitimate. If possible, create a limited test API key on the provider before use.Like a lobster shell, security has layers — review code before you run it.
latestvk975fa6vv8z8grdad9ev2vzce582rben
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
