Doubao Claw
Security checks across malware telemetry and agentic risk
Overview
The code and instructions mostly match a Doubao/Volcengine client, but there are installation and metadata inconsistencies (an unknown Windows installer URL, curl -k usage, and the skill failing to declare the required DOUBAO_API_KEY) that warrant caution before installing.
Do not run the one-line installers without review. Specifically: - The Windows one-liner points to https://cloudcraftshub.com/api (not GitHub) — avoid running msiexec against an unknown host. - The macOS installer examples use curl -k (skips TLS verification); do not use -k. Prefer trusted TLS-verified sources. - The package metadata omitted the required DOUBAO_API_KEY; expect to need that key for the tool to work. Treat any installer that asks for secrets or writes to PATH cautiously. - If you want this tool: inspect scripts/setup.js, scripts/postinstall.js, and the top-level install scripts before executing; better yet, build from source (git clone + cargo build / npm install) or download binaries only from the project's official GitHub Releases page. If you cannot verify the installer contents, do not install.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings