Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Alicloud Ai Search Opensearch
v1.0.3Use OpenSearch vector search edition via the Python SDK (ha3engine) to push documents and run HA/SQL searches. Ideal for RAG and vector retrieval pipelines i...
⭐ 0· 1.1k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and SKILL.md align with the stated purpose: they use the alibabacloud-ha3engine SDK to push documents and run HA/SQL searches on OpenSearch. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and script clearly require multiple OpenSearch credentials (endpoint, instance id, username/password, datasource, etc.). That mismatch is unexpected and should be corrected.
Instruction Scope
The runtime instructions stay within the stated purpose: install the SDK, set OpenSearch env vars, push/search, and save outputs. They do not request unrelated system files or broad context gathering. Note: the examples print API responses and instruct saving evidence files (which may include IDs, responses, or sensitive content).
Install Mechanism
There is no automated install spec (instruction-only). The SKILL.md recommends installing the official pip package alibabacloud-ha3engine in a venv, which is a reasonable approach and lower risk than arbitrary downloads.
Credentials
The env vars required by the SKILL.md (OPENSEARCH_ENDPOINT, OPENSEARCH_INSTANCE_ID, OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD, OPENSEARCH_DATASOURCE, optional PK_FIELD/CLUSTER) are proportionate to the skill's function. The concern is that the skill metadata did not declare any required env vars or primary credential — this inconsistency could confuse permission/secret handling and automation that relies on the registry metadata.
Persistence & Privilege
always is false and the skill does not request persistent or system‑wide privileges. It does not attempt to modify other skills or global agent settings.
Scan Findings in Context
[no_static_findings] expected: Static scan reported no suspicious patterns. The package is instruction-first and includes an SDK client usage pattern which is expected for a provider integration.
What to consider before installing
This skill legitimately needs Alibaba Cloud OpenSearch credentials (endpoint, instance id, username/password, datasource) even though the registry metadata omits them — that inconsistency is the main red flag. Before installing: 1) Only provide credentials with the minimal permissions needed (prefer a read-only account for testing); 2) Run the skill in an isolated environment (venv, limited network) and review outputs written to output/alicloud-ai-search-opensearch/ because API responses may include sensitive identifiers or content; 3) Verify the alibabacloud-ha3engine package source and pin its version; 4) Correctly populate registry/automation with the required env var declarations or refuse to install until metadata matches the SKILL.md. If you cannot confirm the origin of this skill or cannot limit credentials, treat it as higher risk.Like a lobster shell, security has layers — review code before you run it.
latestvk97ejxafrm83e0q9we3xs7xvc982p28b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.