Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ruiguan Image Compliance
v1.0.0基于睿观的产品图片政策合规检测，通过视觉相似度匹配识别潜在违规商品。当用户提到政策合规检查、产品图片合规、违规检测、禁售商品筛查、基于图片的合规审查、上架前风险排查、policy compliance detection, product compliance review, violation detectio...
⭐ 0· 36·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (image compliance detection) matches the included code and API docs: it POSTs an imageUrl to a Ruiguan endpoint and returns similarity results. However, registry metadata claims no required environment variables or primary credential while both the code (scripts/ruiguan_image_compliance_search.py) and references/api.md require an API key via environment variable LINKFOXAGENT_API_KEY. This mismatch is unexplained and therefore concerning. Additionally, the API path includes 'gunPartsSearch', which is more specific than the skill description and should be clarified.
Instruction Scope
SKILL.md and references/api.md instruct calls to two external endpoints (tool-gateway.linkfox.com for detection and skill-api.linkfox.com for feedback). The feedback instructions explicitly ask the agent to report user intent/results and include user text/content in the payload. That means user-provided content (and potentially identifying info or examples) may be sent to an external service; the skill does not document privacy handling or consent. Otherwise, runtime instructions stay within the stated image-similarity task and the included script only posts the imageUrl.
Install Mechanism
No install spec (instruction-only plus a small utility script). Nothing is downloaded or executed at install time; the single Python script performs a straightforward HTTP POST. This is low-install risk.
Credentials
The code requires a single API key (LINKFOXAGENT_API_KEY) to authenticate to the detection API — a proportional need. However, the skill registry metadata incorrectly lists 'Required env vars: none' and 'Primary credential: none', which is inconsistent and could lead to silent failures or confusion. The feedback endpoint appears to require no auth, so sensitive user content could be transmitted without further protections. The requested environment access (one API key) is reasonable for the declared purpose but must be explicitly declared and documented.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and has no install-time persistence. It can be invoked by the agent (normal default).
What to consider before installing
What to consider before installing:
- The skill will call external LinkFox endpoints (tool-gateway.linkfox.com and skill-api.linkfox.com). Confirm you trust that operator and their privacy practices before sending images or user text.
- The code and API docs require an API key via the environment variable LINKFOXAGENT_API_KEY, but the registry metadata does not declare this — ask the publisher to correct the metadata so you know what credentials are needed.
- The skill's feedback feature can send user content (what the user said and why results were wrong) to the feedback endpoint. If you plan to send any private or sensitive content, restrict or disable automatic feedback reporting.
- The API path name (gunPartsSearch) is more specific than the skill description; ask the publisher to clarify what classes of prohibited items the database contains (e.g., weapons/gun parts) to ensure the tool is appropriate for your use.
- If you proceed, scope the API key (least privilege), monitor outbound network calls, and request audit/logging or a data-processing agreement from the provider. If you need help verifying the provider, ask the publisher for a canonical homepage, privacy policy, or published API documentation.Like a lobster shell, security has layers — review code before you run it.
latestvk9710nj4mskdae4gv665m0z1an841gwb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.