Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
FactoriaGo
v2.9.7FactoriaGo platform assistant — AI-driven academic paper revision and resubmission. Activate when user mentions: FactoriaGo, revise paper, reviewer comments,...
⭐ 0· 119·0 current·0 all-time
byGe Yanhao@gyh2556406
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (FactoriaGo paper revision, LaTeX editing, reviewer-response drafting) align with the included files and the client script: the script talks only to editor.factoriago.com and implements project, task, file, chat, and LLM config endpoints consistent with the documentation.
Instruction Scope
SKILL.md and the included docs instruct the agent and user to perform login, manage a session cookie, call /api endpoints, upload LLM API keys to the platform, analyze reviews, edit files, and compile LaTeX. These instructions stay within the stated purpose. Minor mismatch: some docs use factoriago.com vs editor.factoriago.com for endpoints (script uses editor.factoriago.com). The skill explicitly instructs the agent to ask for credentials before API calls and to store the session cookie in an env var rather than in files.
Install Mechanism
Instruction-only skill with a bundled client script; there is no install spec, no downloads, and nothing writes to disk beyond what the user runs locally. This is a low-risk installation model from a delivery standpoint.
Credentials
Registry metadata lists no required env vars or primary credential, but the bundled script expects the session cookie in FACTORIAGO_COOKIE (and the SKILL.md instructs users to export that env var). Additionally, AI features require you to provide your own LLM API key which the skill instructs you to send to the FactoriaGo server via set-llm-config (server-side storage). Requesting a session cookie and API keys is proportionate to the functionality, but the env var requirement was not declared in the registry and the skill instructs the user to upload sensitive credentials to the remote service—this requires trusting the remote platform and the skill author.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence or modify other skills. It does instruct storing a session cookie in an environment variable for the duration of use, which is normal for a client script.
What to consider before installing
What to consider before installing/using this skill:
- The skill appears to do what it says: it calls the FactoriaGo API (editor.factoriago.com) to manage projects, files, review analysis, AI chat, and LaTeX compile.
- Inconsistency to note: the registry reported no required environment variables, but the included client script expects a session cookie in FACTORIAGO_COOKIE. Expect to set that env var or login via the script.
- Sensitive credentials: to use AI features you must provide an LLM API key and the skill instructs saving it to FactoriaGo via POST /settings/llm. That means your LLM API key will be sent to and stored on the FactoriaGo server (allegedly encrypted). Only proceed if you trust the remote service and its privacy/security practices.
- Session cookie power: the session cookie (connect.sid) effectively authenticates your account. Do not paste it into untrusted channels. Prefer using the web UI to configure keys when possible.
- Verify endpoints and domain: the script and docs primarily use editor.factoriago.com; one doc snippet references factoriago.com — confirm you're interacting with the intended domain (editor.factoriago.com) and review the platform's privacy/terms.
- Inspect and run locally in isolation: the full client source is included; review it (it uses HTTPS to editor.factoriago.com and no other remote hosts) and run in an isolated environment if you want to test. Avoid running unknown scripts on sensitive systems.
- If you have doubts, use the web UI instead of giving credentials to the assistant, create a throwaway FactoriaGo account for testing, and confirm the vendor's security posture before uploading production API keys or private manuscripts.
If you want, I can point out the exact lines in the client script that read FACTORIAGO_COOKIE and perform the POST /settings/llm call, or summarize the network requests the script makes.Like a lobster shell, security has layers — review code before you run it.
academicvk978sqxtv2tzjvnvwsx84914vh832gt0aivk978sqxtv2tzjvnvwsx84914vh832gt0latestvk9702mjzb814pscp8ah23zkavs8342bvlatexvk978sqxtv2tzjvnvwsx84914vh832gt0paper-revisionvk978sqxtv2tzjvnvwsx84914vh832gt0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
