Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Doubao Chat

v1.0.0

豆包大模型对话(免费 API,支持联网搜索)

0· 869·2 current·2 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bseye520/doubao-chat.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Doubao Chat" (bseye520/doubao-chat) from ClawHub.
Skill page: https://clawhub.ai/bseye520/doubao-chat
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: curl, node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install bseye520/doubao-chat

ClawHub CLI

Package manager switcher

npx clawhub@latest install doubao-chat
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description claim a Doubao chat with web-search support; the code implements a basic chat client calling https://doubao-free-api.vercel.app/v1/chat/completions which is consistent with a chat skill, but the advertised 'supports联网搜索' (web search) is not implemented in the script. Also SKILL.md metadata lists required binaries ['curl','node'] while the included script only needs node.
Instruction Scope
SKILL.md instructs setting DOUBAO_SESSIONID and running node scripts/chat.js, which matches the script's behavior. The instructions do not read other files or exfiltrate local data. However the runtime instructions mention an API endpoint on a Vercel domain rather than the skill homepage (doubao.com), which is an unexpected divergence the user should confirm.
Install Mechanism
Instruction-only skill with a small included Node script and no install spec — nothing is downloaded or written to disk by an installer. This is low install risk.
!
Credentials
The script requires a DOUBAO_SESSIONID environment variable (used as a Bearer token) but the registry metadata claimed no required env vars; this mismatch is a notable incoherence. No other credentials are requested, which is proportionate, but you should confirm where the session token is valid and whether it grants account-level access.
Persistence & Privilege
The skill does not request always: true and does not persist or modify other skills or system config. It runs only when invoked.
What to consider before installing
This skill appears to be a small Node script that sends prompts to a third‑party API and requires you to provide DOUBAO_SESSIONID (sent as a Bearer token). Before installing: (1) Confirm the DOUBAO_SESSIONID is safe to use here — it may grant access to your Doubao account; prefer a limited/throwaway token if possible. (2) Verify the API host (doubao-free-api.vercel.app) is legitimate and intended by the publisher — the skill's homepage is doubao.com but the API is hosted on Vercel, which may be a proxy. (3) Ask the publisher to correct registry metadata to declare the required env var and to remove the unnecessary 'curl' requirement, and to clarify whether web-search is actually supported. If you cannot verify these points, avoid supplying production or sensitive credentials to this skill.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🤖 Clawdis
Binscurl, node
latestvk975c0b1rhaxxhywa85zy2nj6182hyq4
869downloads
0stars
1versions
Updated 6h ago
v1.0.0
MIT-0

豆包聊天

使用豆包免费 API 进行对话,支持联网搜索。

环境变量

DOUBAO_SESSIONID=your_sessionid

使用方法

node scripts/chat.js "你好"

API 端点

对话补全:POST https://doubao-free-api.vercel.app/v1/chat/completions

Comments

Loading comments...