Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

泽明订单制作

v1.0.0

通过钉钉API导入订单数据,展示20项详细信息供核对,支持确认、重新查询或退出操作。

0· 127·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for duanzhen001/zeming-xiaoshoudingdan-apidiaoyong.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "泽明订单制作" (duanzhen001/zeming-xiaoshoudingdan-apidiaoyong) from ClawHub.
Skill page: https://clawhub.ai/duanzhen001/zeming-xiaoshoudingdan-apidiaoyong
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install zeming-xiaoshoudingdan-apidiaoyong

ClawHub CLI

Package manager switcher

npx clawhub@latest install zeming-xiaoshoudingdan-apidiaoyong
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill description claims '通过钉钉API导入订单数据' (import via DingTalk API), but SKILL.md contains only a static example order_data and print logic — there are no API calls, no auth/environment requirements, and no install steps. A legitimate DingTalk integration would need credentials (token/secret), network calls, and handling for dynamic data; those are missing.
Instruction Scope
The instructions are narrowly scoped to displaying 20 fields from a hard-coded order and presenting A/B/C choices. They do not request reading other files or environment variables. Two items to note: (1) the file contains realistic-looking personal data (name, phone, address) in the sample — this is privacy-sensitive and should be redacted if it's test data; (2) comments state built-in auto-jump rules (choice A triggers '技能2') but there is no definition of '技能2' or how that invocation is authorized, which is ambiguous.
Install Mechanism
No install spec and no code files beyond SKILL.md — lowest-risk from installation perspective. Nothing is downloaded or written to disk by an installer.
!
Credentials
The skill declares no required env vars or primary credential, yet its stated purpose (DingTalk API import) would normally require credentials (token/secret). The absence of any declared credentials is disproportionate to the claimed capability and suggests the description and implementation are out of sync.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent privileges, nor does it modify other skills' configuration in the provided instructions. However, the mention of automatic forwarding to another skill ('技能2') is ambiguous and should be clarified before granting autonomous invocation.
What to consider before installing
This skill's description promises a DingTalk API import but the runtime instructions only show a hard-coded example and printing logic — no API calls, no auth, and no install. Before installing, ask the publisher to: (1) provide the actual code or runtime instructions that perform the DingTalk API calls, including which credentials/env vars are required (e.g., DINGTALK_TOKEN or APP_KEY/APP_SECRET) and why; (2) explain the '技能2' auto-invoke behavior (what it is, when it runs, what permissions it needs); (3) remove or redact any real personal data in examples; and (4) show how credentials are stored/used (avoid embedding secrets in code). If they cannot justify the missing API/auth pieces or clarify the auto-invocation, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk971fd0e945t4j7f70nyjn37cs83nseq
127downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

龙虾技能名称:zeming-xiaoshoudingdanhedui

功能:钉钉API导入 → 20项展示核对 → A/B/C选择

order_data = { "审批编号": "202603220741000009948", "所在部门": "办公室-业务部", "顾客姓名": "李鸿冰", "客户地址": "陕西省西安市港务区西派璟悦一单元1802", "联系电话": "18993318889", "产品类型": ["洗衣机", "电视"], "品牌": ["卡萨帝", "海信"], "产品型号": ["CE B10LWDUBHKU1", "75D3K"], "订购数量": [1, 2], "单价": [5000, 3199], "合计金额": [5000, 6398], "收回手续": 0, "是否开票": "是", "交款方式": "电汇", "配送方式": "库房送货", "是否参与节能补贴": "门店补贴", "开发票金额": [5000, 6398], "补贴金额": [750, 959.70], "订购说明": "咸鱼销售", "发起人": "段震" }

def show_20_items(): print("===== 钉钉20项指定项目展示 =====") print(f"1 审批编号:{order_data['审批编号']}") print(f"2 所在部门:{order_data['所在部门']}") print(f"3 顾客姓名:{order_data['顾客姓名']}") print(f"4 客户地址:{order_data['客户地址']}") print(f"5 联系电话:{order_data['联系电话']}") print(f"6 产品类型:{'、'.join(order_data['产品类型'])}") print(f"7 品牌:{'、'.join(order_data['品牌'])}") print(f"8 产品型号:{' / '.join(order_data['产品型号'])}") print(f"9 订购数量:{' / '.join(map(str, order_data['订购数量']))}") print(f"10 单价(元):{' / '.join(map(str, order_data['单价']))}") print(f"11 合计金额:{' / '.join(map(str, order_data['合计金额']))}") print(f"12 收回手续:{order_data['收回手续']}") print(f"13 是否开票:{order_data['是否开票']}") print(f"14 交款方式:{order_data['交款方式']}") print(f"15 配送方式:{order_data['配送方式']}") print(f"16 是否参与节能补贴:{order_data['是否参与节能补贴']}") print(f"17 开发票金额(元):{' / '.join(map(str, order_data['开发票金额']))}") print(f"18 补贴金额(元):{' / '.join(map(str, order_data['补贴金额']))}") print(f"19 订购说明:{order_data['订购说明']}") print(f"20 发起人:{order_data['发起人']}")

print("\n请选择操作:")
print("A - 数据完全正确,继续下一步")
print("B - 数据有错误,重新查询钉钉API")
print("C - 退出流程")

执行展示

show_20_items()

龙虾自动跳转规则(已内置)

用户选择 A → 自动执行 技能2

用户选择 B → 重新执行本技能

用户选择 C → 结束

Comments

Loading comments...