ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alt Text Batch

v1.0.0

Batch-process multiple images to generate AI-powered alt text descriptions for accessibility. Supports up to 500 images per run.

⭐ 0· 29·0 current·0 all-time
by@ntriq-gh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match the implementation: src/main.js implements batch processing, calls an external AI endpoint, and charges per-success via Apify. However, registry metadata indicated 'No install spec — instruction-only', while the package includes code (src/main.js, package.json, VERIFY_BUILD.sh). Documentation (BUILD_COMPLETE.md/README) repeatedly references .actor configuration files and Dockerfile that are not present in the provided file manifest. These mismatches between declared packaging and actual manifest are inconsistent and worth investigating.
✓
Instruction Scope
SKILL.md and the code instruct the agent to validate URLs, POST image_url and prompt to an external AI service (ai.ntriq.co.kr), push results to Apify dataset, and charge per success. The instructions do not request arbitrary local file reads or unrelated environment variables. They do reference Apify CLI usage and Apify Actor APIs (Actor.getInput, Actor.pushData, Actor.charge), which is expected for an Apify Actor.
ℹ
Install Mechanism
No install spec is declared in the registry metadata (instruction-only), but the bundle includes code and a package.json with dependencies (apify, node-fetch). The README/BUILD_COMPLETE claim a Dockerfile and .actor configs; those files are not present in the manifest provided. This mismatch is suspicious (could be an incomplete package or metadata error). There is no remote download URL or extra installer — which reduces direct supply-chain risk — but if you intend to run this actor you will need to install Node deps and the Apify environment yourself.
✓
Credentials
The skill does not require secrets or credentials in requires.env. It accepts optional AI_API_ENDPOINT and AI_REQUEST_TIMEOUT environment variables, which is reasonable. The code does network calls to ai.ntriq.co.kr and will transmit image URLs and prompts to that external service; no other unrelated credentials or host config are accessed. No env vars that look like tokens/credentials are requested by the skill itself.
✓
Persistence & Privilege
The skill does not ask for always:true or try to modify other skills. It uses Apify Actor APIs (Actor.pushData, Actor.charge) which is expected and appropriate. Default autonomous invocation is unchanged. No evidence it tries to persist across agents beyond normal Apify actor execution.
What to consider before installing
This skill appears to do what it claims (batch alt-text generation) but before installing or running it you should: 1) Verify the vendor/service (ntriq / ai.ntriq.co.kr) and review its privacy/TOS — images (URLs) and prompts are sent to that external API and the service could fetch/store those images. 2) Confirm the missing files/metadata: README and BUILD_COMPLETE reference .actor files and a Dockerfile that aren't in the provided manifest — ask the publisher for the full repository or clarify whether the package is complete. 3) Test with non-sensitive, public sample images to confirm behavior, dataset retention, and billing (Actor.charge is used; costs accumulate per success). 4) If you need stronger guarantees (no remote fetching or storage), request documentation about how the AI endpoint handles images, retention, access controls, and data deletion. 5) If you are not comfortable with sending image URLs to an unfamiliar external service, do not install/run the skill until vendor identity and data handling are confirmed.
✗
src/main.js:4
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk970pp9sw19mmdt4nf0dtws5718429h5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments