Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Fact Check Verify
v1.0.5嚴謹多來源資訊查核與可信度判定技能。用於「查證/核實/核實這個/是真的嗎/是否正確」類請求，整合政府、官方、主流媒體、事實查核站、X(Twitter)、Reddit 等來源，採用內部 100 分制規則化評分（不對使用者公開分數），並強制 Tavily 優先與明確 fallback 規則。
⭐ 0· 186·2 current·2 all-time
byAllen Niu@nhzallen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (multi-source fact checking) align with the included code and instructions: claim extraction, deterministic scoring, and compose/score/ extract commands. The presence of a local factcheck_engine.py implementing extract/score/compose is expected. Minor mismatch: SKILL.md heavily prescribes using Tavily / Twitter / Reddit tooling, but the skill's declared requirements list no environment variables or credentials (e.g., TAVILY_API_KEY is referenced in docs but not declared as required).
Instruction Scope
The SKILL.md instructs the agent to prefer Tavily when TAVILY_API_KEY is available and to use optional Twitter/Reddit CLIs that rely on cookie files. Those runtime expectations reference environment/config secrets (API key and cookie files) even though the skill metadata lists none. The skill also enforces strict output formatting and forbids exposing internal scores (policy choice, not technical risk). The instructions encourage accessing local cookie files (and advise on storage), which is sensitive: the skill's docs imply the agent or operator will load/use cookies but give no explicit safe handling hooks. Also: SKILL.md says up to 5 links in output, but the compose implementation only collects up to 3 — an inconsistency between instruction and implementation.
Install Mechanism
No install spec is provided (instruction-only plus a small Python script). There is no remote download or install step, and the included Python script is readable and small. This is low installation risk.
Credentials
Metadata declares no required env vars, but SKILL.md explicitly conditions behavior on TAVILY_API_KEY and recommends use of Twitter/Reddit cookies for optional CLI tools. The skill therefore expects access to secrets/configuration not declared in the manifest. The docs recommend storing cookie files and rotating them — which is responsible advice — but a user should not expose full‑privilege personal cookies to an agent without using least‑privilege accounts. The code itself does not read env vars or cookie files directly, but runtime instructions depend on external tools that do, so this is a proportionality/visibility gap the user should be aware of.
Persistence & Privilege
The skill is not always-enabled and does not request system-level persistence or to modify other skills. It reads/writes workspace files as part of its normal operation (claims/evidence/scored outputs), which is expected and proportionate.
What to consider before installing
This skill appears to implement a legitimate fact‑checking workflow and includes readable Python code for extract/score/compose. However, the SKILL.md expects the agent/operator to use a Tavily API key and optional Twitter/Reddit cookie-based CLIs even though the skill manifest lists no required credentials — treat that as an intentional but undocumented dependency. Before installing or enabling:
- Decide whether you will provide TAVILY_API_KEY or local cookie files. If you do, use least-privilege accounts and revoke/rotate tokens/cookies used for verification. Avoid exposing your primary personal account cookies.
- Review and run scripts/factcheck_engine.py in a sandbox to confirm behavior and outputs (the code is small and readable). Note the SKILL.md ↔ implementation inconsistencies (e.g., SKILL.md says up to 5 links; the code returns up to 3).
- If you rely on external CLIs, vet those projects separately (they may require cookies/tokens).
- If you want to avoid sharing credentials, run the skill without Tavily/CLI tools; it will still operate but with reduced automated search capability (you should confirm how the agent will perform searches in that case).
Given the manifest/instruction discrepancies (env vars and output counts) and the guidance to use sensitive cookie files, treat this skill with caution until you decide how credentials will be handled. If you want, I can list the exact lines in the files that reference TAVILY_API_KEY, cookie usage, and the compose max_links mismatch for easier review.Like a lobster shell, security has layers — review code before you run it.
arabicvk97d0ak0xc0cqw885phaczhkbx833xzwchinesevk97d0ak0xc0cqw885phaczhkbx833xzwclaim-analysisvk97d0ak0xc0cqw885phaczhkbx833xzwcredibility-scoringvk97d0ak0xc0cqw885phaczhkbx833xzwdisinformationvk97d0ak0xc0cqw885phaczhkbx833xzwenglishvk97d0ak0xc0cqw885phaczhkbx833xzwfact-checkvk97d0ak0xc0cqw885phaczhkbx833xzwlatestvk97d0ak0xc0cqw885phaczhkbx833xzwmisinformationvk97d0ak0xc0cqw885phaczhkbx833xzwmultilingualvk97d0ak0xc0cqw885phaczhkbx833xzwnews-verificationvk97d0ak0xc0cqw885phaczhkbx833xzwosintvk97d0ak0xc0cqw885phaczhkbx833xzwreddit-searchvk97d0ak0xc0cqw885phaczhkbx833xzwsource-validationvk97d0ak0xc0cqw885phaczhkbx833xzwspanishvk97d0ak0xc0cqw885phaczhkbx833xzwverificationvk97d0ak0xc0cqw885phaczhkbx833xzwx-searchvk97d0ak0xc0cqw885phaczhkbx833xzw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.