投票鸭助手

• Verdict: Advisory
• Analyzed: Apr 22, 2026, 10:47 PM
• Findings: 0
• Version: 1.0.0
• Hash: 05c501ff796ceb9f708253195c7ad04d48d96233506a427b2239f8a48cf0f140
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: toupiaoya-skill Version: 1.0.0 The skill bundle provides a legitimate integration for the 'Toupiaoya' (Voting Duck) platform, allowing an AI agent to search for voting templates, create voting projects, and manage materials. It includes a well-structured CLI and Python library that handles authentication by storing tokens in `~/.toupiaoya/config.json` with appropriate file permissions (0o600). The code uses standard libraries like `requests` and the official Tencent Cloud COS SDK for file uploads, and all network communication is directed toward verified domains associated with the service (e.g., toupiaoya.com, eqxiu.com). No evidence of malicious intent, data exfiltration, or prompt injection was found.