ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

byteplan-api

v1.0.0

BytePlan 数据平台 API 封装。提供登录认证、模型查询、数据获取等接口。可被其他 skill（如 byteplan-ppt、byteplan-word、byteplan-video）依赖使用。

⭐ 0· 48·0 current·0 all-time
by@dbfu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
ℹ
Purpose & Capability
The code and SKILL.md implement a BytePlan API wrapper (login, token management, model/data queries) which aligns with the skill's description. However some requested behaviors (credential file path and env handling) in the docs do not match the code implementation (see instruction_scope and environment_proportionality).
!
Instruction Scope
SKILL.md says credentials are stored at ~/.byteplan/.env and describes prompting the user. The actual code (getEnvPath, readEnvContent, saveCredentials) first looks for a .env in the current working directory and falls back to a relative skill path (../../.env). That means at runtime the skill can read from and write to a project's .env (or the skill bundle .env), not necessarily the user home ~/.byteplan/.env as documented — surprising scope that can touch unrelated projects' secrets. The code also auto-loads dotenv (import 'dotenv/config') so it will read .env into process.env at startup.
ℹ
Install Mechanism
No install spec is provided (instruction-only), so nothing is downloaded during install. The package.json lists a small dependency (dotenv) and code files are included in the skill bundle. That means runtime will execute included JS; there is no third-party binary download during install but the mismatch between packaged code and absent install instructions may be confusing.
!
Credentials
Registry metadata declares no required env vars, but both SKILL.md and code rely on BP_ENV, BP_USER, BP_PASSWORD (and set ACCESS_TOKEN, REFRESH_TOKEN, TOKEN_EXPIRES_IN). The code reads process.env and can return cached tokens. The undeclared/implicit access to many environment variables and the fact it persists credentials to a .env file (and may choose cwd/.env) is disproportionate without clearer safeguards.
!
Persistence & Privilege
The skill persists credentials and tokens to disk via saveCredentials (writes a .env file at getEnvPath). Although always:false, the skill still writes persistent secrets to filesystem and may overwrite an existing .env in the current working directory or write into the skill bundle path. This provides persistent storage and increases blast radius if the path is not restricted to a dedicated ~/.byteplan/ folder.
What to consider before installing
What to consider before installing/using this skill: - Inconsistency: SKILL.md says credentials go to ~/.byteplan/.env but the code preferentially reads/writes a .env in the current working directory (cwd) or a relative skill path. That can accidentally overwrite or read unrelated projects' .env files containing secrets. - Credential persistence: The skill will ask for your phone/password and persist BP_USER/BP_PASSWORD and tokens unencrypted to a .env file. If you don't want credentials on disk, don't use the automatic save. - Dotenv behavior: The code imports 'dotenv/config', which auto-loads any .env in the working dir into process.env at runtime — this may expose other project secrets to the skill code. - Mitigations: - Inspect the code locally (getEnvPath, saveCredentials, login/loginWithEnv) and, if needed, modify getEnvPath to use an explicit path (e.g., path.join(os.homedir(), '.byteplan', '.env')) and ensure proper file permissions. - Run the skill in an isolated environment (container or dedicated directory) so it cannot touch unrelated .env files. - If you permit persistence, pre-create ~/.byteplan/.env with correct permissions and ensure working directory does not contain a .env you care about. - Verify the BASIC_AUTH header value and overall network endpoints (dev/uat) against a trusted source; ask the publisher for a homepage/source repository (none provided) and a maintainer identity before trusting credentials. - If you cannot verify or adjust the code, treat this skill as risky for production use and avoid storing real credentials with it.
✗
scripts/api.js:16
Environment variable access combined with network send.
!
scripts/api.js:40
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e285wvwsfxj59s5zefr5tv5840nk7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments