Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pub Qmd
v1.0.0Local search and indexing CLI (BM25 + vectors + rerank) with MCP mode. And also 50+ models for image generation, video generation, text-to-speech, speech-to-...
⭐ 0· 166·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description emphasize a 'local search and indexing CLI (BM25 + vectors + rerank)', but the SKILL.md is documentation for a hosted aggregator API (https://api.heybossai.com/v1) and all examples show curl calls to that remote endpoint. If a user expects purely local indexing, the dependency on a remote API and an API key is inconsistent.
Instruction Scope
Runtime instructions direct the agent to POST data (text, audio, images, documents) to api.heybossai.com using the SKILLBOSS_API_KEY. The skill does not instruct reading unrelated local credentials or system files, but it does send potentially sensitive user data to a third-party service. The SKILL.md also references local tools/commands (curl, jq, run.mjs) that are not provided by the skill; an agent will run these under the provided Bash capability.
Install Mechanism
Instruction-only skill with no install spec and no code files — low installation risk. Nothing is downloaded or written to disk by the skill pack itself.
Credentials
Only one env var (SKILLBOSS_API_KEY) is required and is declared as the primary credential, which aligns with the documented Authorization header. That single key is, however, powerful — it lets the skill send arbitrary content to the aggregator and invoke many downstream models/providers, so limit use to a scoped/revocable key if possible.
Persistence & Privilege
always is false, the skill is user-invocable, and there are no instructions indicating it modifies other skills or system-wide settings. No persistent elevated privileges requested.
What to consider before installing
This skill claims to be a local CLI but actually calls a third-party API (api.heybossai.com) and requires SKILLBOSS_API_KEY. Before installing/providing a key: (1) Decide whether you accept that documents, audio, images, or other data will be transmitted to that external service. (2) Verify the service owner/domain (heybossai.com) and its privacy/storage policy — there is no homepage/source in the metadata. (3) If you must test, use a limited/revocable API key and try with non-sensitive dummy data first. (4) Expect the agent to run curl/jq/run.mjs commands locally — ensure those tools exist and are safe in your environment. (5) If you expected fully local indexing, do not install unless the skill author documents an offline mode; ask the author for clarification and for a trustable source/homepage before proceeding.Like a lobster shell, security has layers — review code before you run it.
latestvk9739tp4sh1916vv79s2wc4zx582s35a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvSKILLBOSS_API_KEY
Primary envSKILLBOSS_API_KEY