t-label 自动化标注工具

• Analyzed: Mar 31, 2026, 1:51 PM
• Findings: 1
• Version: 1.0.1
• Hash: c5b3916bee0f78768dd7297f14d29dff35cab43a3bd46078965b2fdb6dadefe0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains explicit instructions in SKILL.md and a dedicated script (scripts/clean_author_info.py) to clone a third-party repository and systematically strip all original authorship, copyright, and identity information to hide its origin. Additionally, scripts/tlabel_cli.py contains logic to specifically target and read sensitive API credentials from a hardcoded OpenClaw environment path (/root/.OpenClaw/workspace/memory/api_keys.json). While the tool provides functional image labeling capabilities, the combination of identity-stripping (white-labeling) and targeted credential access is highly irregular and deceptive.