Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
YoudaoNote
v1.0.0Use when the user wants to interact with YoudaoNote (有道云笔记) — listing, reading, creating, searching notes, clipping web pages, or saving Markdown/mindmap not...
⭐ 0· 225·3 current·3 all-time
byCheng@huangcheng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and SKILL.md all consistently describe using a youdaonote CLI to list, read, create, search, clip, and save notes. Required capabilities described (API key configuration) match the stated purpose; no unrelated service credentials or binaries are requested.
Instruction Scope
Instructions are narrowly scoped to installing and using a youdaonote CLI and configuring an API key. However, the SKILL.md explicitly directs running a remote installer via `curl -fsSL https://artifact.lx.netease.com/download/youdaonote-cli/install.sh | bash`, which grants the remote script authority to write/execute on the host — an out-of-band action beyond the skill’s pure instruction scope and worth caution.
Install Mechanism
There is no registry install spec, but the README instructs piping a shell install script from artifact.lx.netease.com into bash. This is a high-risk pattern: it downloads and executes arbitrary remote code. The URL is not a well-known packaged-release host (e.g., GitHub release or major package manager) in the skill metadata, and the registry listing provides no checksums or signatures to verify the installer.
Credentials
The skill declares no required env vars or credentials. The SKILL.md asks the user to set an API key in the CLI (youdaonote config set apiKey), which is proportional to a note-syncing CLI. There are no requests for unrelated secrets or system-level credentials.
Persistence & Privilege
The skill is instruction-only, does not request always:true, and does not modify other skills or declare config path access. It does rely on installing a third-party CLI which may persist on disk — that persistence is due to the installer (see install_mechanism concern), not the skill metadata.
What to consider before installing
This skill appears to be a genuine usage guide for a YoudaoNote CLI, but the SKILL.md tells you to run a remote install script (curl | bash). That action will execute code from a remote server on your machine — treat it as risky unless you trust the source. Before installing: (1) verify the installer URL belongs to the official vendor (artifact.lx.netease.com appears related to NetEase but confirm official documentation), (2) fetch the script first (curl … -o install.sh) and review its contents and any checksums/signatures instead of piping to bash, (3) prefer installing from a trusted package manager or signed release when available, (4) run the installer in a sandbox/VM if possible, and (5) verify where the CLI stores your API key and what network calls it makes. If you cannot verify the installer's provenance or inspect it safely, avoid running the script.Like a lobster shell, security has layers — review code before you run it.
latestvk976pfwq887t2zdfrc2pwvg8r9832dpk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.