t-cpm自定义技能

• Analyzed: Mar 31, 2026, 8:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 54dd5b29a4bc8378c3315ce2aec97976aa11e7fca633ca12c2ef15ad068d39f2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements an automated image filtering tool that deletes local files based on AI model judgments, which poses a significant risk of unintended data loss due to potential AI hallucinations or prompt injection. The script `scripts/image_filter_pipeline.py` reads sensitive API credentials from a hardcoded local configuration file (`/root/.OpenClaw/workspace/conding-plan-models.json`) and performs file deletions (`os.remove`) based on remote API responses. While these behaviors are documented as the tool's primary purpose in `SKILL.md`, the combination of automated file system modification and credential handling is inherently high-risk.