Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Doubao Launch

v1.0.6

Launch Doubao desktop application and configure real-time translation window.

0· 417·5 current·5 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to run a Python automation script (doubao_auto_workflow.py) to launch a Windows GUI via WSL, which is consistent with the described purpose. However, no script or binaries are included in the bundle and the plugin manifest's entry field points to an absolute local path (/mnt/h/AI/openclaw_workspace/...) that appears to be the developer's machine layout. The skill does not declare required local prerequisites (Windows Python, WSL, Doubao app, the script path), so the declared capability is not matched by what is provided.
Instruction Scope
SKILL.md instructs the agent to execute a local Python script via WSL and to interact with the Windows desktop and files (works/ directory, /mnt/h/...). These instructions are within the domain of a GUI automation skill, but they grant the agent permission to run arbitrary local code and access Windows filesystem paths. Because the referenced script is not included, the instructions are effectively a pointer to external local code the user must already have; that missing piece is a risk (you should inspect that script before running).
!
Install Mechanism
There is no install spec (instruction-only), which is low-risk in itself. However, the openclaw.plugin.json 'entry' points to an absolute host path (under /mnt/h/...) but no code is bundled. This mismatch means the skill expects files to already exist on the user's machine or developer environment, which is incoherent and could lead an agent to attempt to access arbitrary local paths.
Credentials
The skill requests no environment variables or credentials and does not attempt to read unrelated secrets in SKILL.md. That is proportionate for a local GUI automation helper. It does, however, assume access to WSL and Windows filesystem mounts—these are reasonable but undocumented prerequisites.
Persistence & Privilege
The skill does not request always:true or any elevated persistent presence. It is user-invocable and allows normal autonomous invocation by the agent (platform default). No attempts to modify other skills or system-wide configs are present in the provided files.
What to consider before installing
Do not install or run this skill without confirming where the referenced script (doubao_auto_workflow.py) comes from. The package contains only metadata and instructions; the actual automation script is missing and the plugin entry points to an absolute path on the developer's machine. Before using: 1) obtain and inspect the full Python script (and any helpers) to verify it does only the expected GUI automation; 2) ensure you understand and accept that the agent will run local code via WSL and interact with your Windows desktop and files; 3) verify you have the Doubao app, WSL, and Windows Python installed in the expected locations; 4) prefer a version hosted on a project repository/homepage or a packaged release rather than relying on local absolute paths. If you cannot review the missing script, treat this skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk979gf26x8byr2py65e2z4p1vx82gfcf
417downloads
0stars
7versions
Updated 6h ago
v1.0.6
MIT-0

Doubao Launch

Usage

python scripts/doubao_auto_workflow.py [--dual|--single] --json-output

Parameters

  • mode (optional): "dual" or "single", default: "dual"

Returns

{
  "success": true,
  "window_handle": 123456,
  "window_title": "Doubao - Real-time Subtitles",
  "mode": "dual"
}

Tools

launch_doubao

Launch Doubao application

Workflow Integration

This skill is part of the YouTube translation workflow:

  1. youtube-audio-download: Download audio from YouTube
  2. doubao-launch: Launch Doubao translation window
  3. audio-play: Play the downloaded audio
  4. doubao-capture: Capture translated subtitles

Execution

All skills execute on Windows Python via WSL cross-platform call:

wsl -> python.exe scripts/doubao_auto_workflow.py ...

Error Handling

All skills return JSON with success field:

  • success: true - Operation completed
  • success: false - Check error_code and error_message

Notes

  • Windows GUI automation requires visible desktop (no RDP disconnect)
  • Output files are stored in Windows works/ directory
  • WSL accesses Windows files via /mnt/h/...

Comments

Loading comments...