ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

english-game

v1.0.0

run a feishu or lark english game with lightweight group-chat interaction. use when users want an english game, vocab challenge, wordle-like word guessing, d...

⭐ 0· 118·0 current·0 all-time
byHeiMaoM@hei-maom
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Feishu/Lark English game) match included helpers: a deterministic vocab scoring script and an ASR transcription script used by the speaking mode. The external ASR API key (SENSEAUDIO_API_KEY) is appropriate for transcription functionality.
✓
Instruction Scope
SKILL.md instructs only chat/game behavior, maintaining session state in-chat, scoring guesses via scripts, and sending audio to SenseASR for transcription. It explicitly forbids dumping raw JSON to chat. The instructions do require reading local audio files (for transcription) and using an environment API key, which is coherent with the speaking mode.
✓
Install Mechanism
No install spec or external downloads are present; the skill is instruction + local scripts only. No archives or remote installers are fetched by the skill.
ℹ
Credentials
The scripts and SKILL.md require SENSEAUDIO_API_KEY (and optionally SENSEAUDIO_BASE_URL) which is proportionate to ASR usage. However the registry metadata listed 'Required env vars: none' — this mismatch should be resolved before install.
✓
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system settings. It runs as an invoked skill and has no elevated platform privileges.
Assessment
This skill appears to do what it says: play vocab/guess/speaking games and call SenseASR for transcription. Before installing: (1) supply a SENSEAUDIO_API_KEY if you want speaking mode to work — the SKILL.md requires it even though the registry metadata omitted it; (2) consider privacy: voice files will be uploaded to the external SenseASR endpoint (default https://api.senseaudio.cn) — confirm you trust that service and its data-retention policies; (3) avoid setting SENSEAUDIO_BASE_URL to untrusted endpoints; (4) verify you are comfortable with the skill reading local audio file paths (it checks file existence and opens the file) and sending them out; (5) if you expect the skill to run without ASR, speaking mode will not function. Resolve the metadata discrepancy about required env vars before deployment.

Like a lobster shell, security has layers — review code before you run it.

latestvk970s3npz0rf956g0q3zc7m72s833dmp

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments