ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

翱象发品

v1.0.2

Manage batch creation of goods SKUs using Java JDK 8 by executing openclaw_demo.jar with specified merchant, store, and SKU details in JSON format.

⭐ 0· 247·0 current·0 all-time
by@bigmountains
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The top-level description says the skill runs a Java JDK8 openclaw_demo.jar, yet SKILL.md contains only Python usage examples (scripts/aoxiang_publish.py) and references a Java REFERENCE.md — none of these code files exist in the package. This inconsistency between claimed implementation (Java/JAR) and provided instructions (Python, missing scripts) is unexpected and unexplained.
ℹ
Instruction Scope
SKILL.md documents API parameters, the MD5 signing algorithm, example Python client usage, and CLI invocation. It does not instruct reading unrelated system files or env vars, nor does it include an endpoint URL. However, it references local files (scripts/aoxiang_publish.py, REFERENCE.md) that are not present in the package, making the runtime behavior unclear. The signing description is slightly ambiguous about whether 'secret' is transmitted or only used for signing.
✓
Install Mechanism
There is no install spec and no code files — the skill is instruction-only, so nothing is written to disk by the registry. This is low risk from an install-mechanism perspective. The missing referenced files are an availability/integrity issue but not an installation risk.
!
Credentials
The instructions clearly require an app_key and secret (used for signing) but the skill metadata lists no required environment variables or primary credential. The manifest not declaring these secrets is an omission that makes it unclear how credentials are expected to be provided and audited.
✓
Persistence & Privilege
Default privileges apply (always: false, agent-invocable). The skill does not request persistent or elevated platform presence in the manifest.
What to consider before installing
This package is inconsistent: its description promises a Java/JAR-based tool but the README shows Python examples and refers to local scripts that aren't included. Before installing or providing credentials, ask the publisher for the missing files (scripts/aoxiang_publish.py, REFERENCE.md, or the openclaw_demo.jar) and an explicit endpoint URL. Do not supply your app_key/secret until you can inspect the actual code that will execute them. If you must test it, run in an isolated environment (container or sandbox) and prefer ephemeral credentials you can revoke. If you can't get a coherent explanation or the source code, treat it as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk970155cf7greze1v994hzgm7n82z2e9

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments