Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Medo App Builder
v1.0.0Create, modify, generate, and deploy websites, web apps, dashboards, SaaS products, internal tools, interactive web pages, Weixin mini program , games on the...
⭐ 0· 44·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, required binary (python3), and required env var (MEDO_API_KEY) align with a CLI client for the Medo platform. HOWEVER the packaged CLI defaults to a hard-coded AWS API Gateway URL (https://cwk7oh9oyc.execute-api.us-west-2.amazonaws.com) rather than the official domain mentioned in the README (medo.dev). This is an inconsistency: it may be a legitimate API gateway/proxy but the skill provides no explanation or homepage to justify it.
Instruction Scope
SKILL.md stays within the stated purpose (chat→generate→publish workflow) and instructs use of the included CLI only (good). It does not instruct reading arbitrary local files or unrelated env vars. Two practical issues: 1) the script depends on the Python 'requests' package but SKILL.md only requires 'python3' (does not mention pip install requests), and 2) the CLI accepts MEDO_BASE_URL but the skill metadata and documentation do not declare or discuss this override or the default host—this omission increases risk.
Install Mechanism
No install spec or remote downloads; this is an instruction-only skill plus a bundled Python script. Nothing in the manifest writes remote code to disk at install time beyond the included files.
Credentials
Only MEDO_API_KEY is required, which is proportionate for a platform client. But the API key will be sent to the script's default endpoint (the AWS execute-api hostname) unless MEDO_BASE_URL is set; because the endpoint does not match the documented medo.dev site and the skill's source is unknown, granting the API key has non-trivial risk—verify the receiving endpoint is legitimately owned by Medo before supplying credentials.
Persistence & Privilege
The skill does not request 'always' presence, does not modify other skills, and has no install-time hooks. It only runs when invoked, which is proportionate.
Scan Findings in Context
[hardcoded_default_api_host] unexpected: The script sets DEFAULT_BASE_URL to https://cwk7oh9oyc.execute-api.us-west-2.amazonaws.com. This does not match the documented official domain (medo.dev) and there is no homepage/source to justify the gateway. Not expected for a straightforward official client.
[uses_requests_library] expected: The client performs HTTP requests and therefore imports 'requests'. This is expected for a networked CLI. However SKILL.md does not declare the dependency (pip install requests).
What to consider before installing
Before installing or running: 1) Do not paste your real MEDO_API_KEY until you verify the endpoint that will receive it — confirm the DEFAULT_BASE_URL/MEDO_BASE_URL is an official Medo endpoint or controlled by a trusted operator. 2) Inspect the bundled script (scripts/medo_api.py) yourself or ask the publisher for provenance; the package is from an unknown source and has no homepage. 3) Install the Python 'requests' package in an isolated environment before running. 4) If you proceed, consider using an API key with limited scope or a test account to reduce blast radius. 5) If you cannot verify the API host or publisher, treat this skill as untrusted and do not provide production credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk970t44pwaabps93te0a4nphf583jwng
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
EnvMEDO_API_KEY
Primary envMEDO_API_KEY