Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Yutori research
v1.0.1Use Yutori’s Research API and Browsing API (cloud browser) to research topics, collect sources, and extract structured facts from the web. Use when the user asks to “research X”, “monitor/find papers”, or “navigate to a site and extract info” and you have access to YUTORI dev/prod endpoints via YUTORI_API_BASE and an API key in env (YUTORI_API_KEY or ~/.openclaw/openclaw.json env.YUTORI_API_KEY).
⭐ 0· 2.1k·0 current·0 all-time
by@juanpin
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description => calling Yutori Research and Browsing APIs; the included Node runner and SKILL.md implement exactly that. Required functionality (POST /v1/research/tasks and /v1/browsing/tasks) aligns with the stated purpose.
Instruction Scope
SKILL.md instructs the agent to create and poll research/browsing tasks and to return structured results. The included script only performs API calls, polling, and prints results. However both SKILL.md and the script reference reading ~/.openclaw/openclaw.json as a fallback for the API key — this means the skill will read a local config file in the user's home directory, which can contain other environment settings or secrets.
Install Mechanism
No install spec; this is an instruction-only skill with a small runner script bundled. No downloads, no archive extraction, and no package installs — low install risk.
Credentials
SKILL.md and the script require a YUTORI_API_KEY and suggest a YUTORI_API_BASE, but the registry metadata lists no required env vars or primary credential. That mismatch is an incoherence. The script will read the file ~/.openclaw/openclaw.json to extract env.YUTORI_API_KEY as a fallback — reading that file may expose other saved env values if the script is modified or extended.
Persistence & Privilege
always: false and no install hooks. The skill does not request persistent system presence or modify other skills' configs. It runs network calls to the declared API base (default dev/prod yutori endpoints).
What to consider before installing
This skill appears to do what it says (call Yutori research/browsing APIs), but be cautious before installing/using it: 1) The registry metadata does NOT declare the YUTORI_API_KEY requirement even though SKILL.md and the script use it — treat that as a packaging/information error and prefer to see the credential declared explicitly in the registry. 2) The bundled script will attempt to read ~/.openclaw/openclaw.json as a fallback to obtain the API key; review that file and the runner script before running to ensure you’re not unintentionally exposing other secrets. 3) Prefer setting YUTORI_API_KEY in a controlled environment variable rather than relying on a shared config file. 4) Verify the API key’s permissions (Research vs Browsing) and the intended API_BASE (dev vs prod) before use. If you do not trust the skill source, do not run the script or provide your API key until the registry metadata and SKILL.md are consistent and you have audited the code.Like a lobster shell, security has layers — review code before you run it.
latestvk973v689r9fxqh7kkepyh1j72s80brpn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.