Openclaw Skill

PassAudited by ClawScan on May 9, 2026.

Overview

This is a coherent paid API-wrapper skill, but users should know it sends their submitted text to a remote service and may require a small Alipay payment per use.

This skill appears coherent and purpose-aligned. Before installing, be aware that each service call may require a small Alipay payment and that submitted resumes, contracts, marketplace details, or compliance drafts are sent to the remote API for processing.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill may trigger a 0.10 CNY payment flow for each API call once the user authorizes payment.

Why it was flagged

The skill discloses a per-call paid workflow using Alipay A2M. This is expected for the stated paid service, but it involves delegated payment authority after user authorization.

Skill content

统一价格：0.10元/次 ... 支付宝AI收会自动处理付费流程，用户授权后即可使用

Recommendation

Only approve payment prompts when you intentionally want to use the service, and monitor repeated calls if asking for multiple outputs.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Text you provide for review or generation may be sent to the remote service operator for processing.

Why it was flagged

The client posts the user's JSON input to a remote API endpoint. The SKILL examples include resumes, rental contracts, and content drafts, which can contain sensitive personal or business information.

Skill content

API_BASE_URL = "https://w4h8ghmxcv.coze.site" ... data = json.dumps(body).encode('utf-8') ... method='POST'

Recommendation

Avoid submitting highly sensitive personal, legal, financial, or confidential business information unless you trust the service and its privacy handling.