Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

17ce Speedtest

17CE Global Website Speed Test Tool. Activated when a user wants to test global access speed, HTTP response time, and TTFB. Retrieves real-time speed data fr...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 25 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description align with the included Python scripts (WebSocket-based global speed tests and HTML/JSON reports). Requesting/using credentials and contacting 17CE endpoints is coherent for a hosted speed-test service. However, embedding a default API account (email + apipwd) inside SKILL.md is unusual and notable (see environment_proportionality).
!
Instruction Scope
SKILL.md mandates automatic execution of scripts/speedtest_ws.py (including a 'MUST' override for the AI-model-availability check) and instructs the agent to run that script against a list of major AI provider API endpoints. The scripts send the tested URL and authentication (user + apipwd) to the remote 17CE WebSocket API and will report results back. That means any URL the agent tests (including internal or private URLs) will be transmitted to a third-party service. The 'automatic' trigger on phrases like 'check current availability of major global AI models' could cause the agent to run many probes without additional explicit confirmation.
Install Mechanism
There is no install spec despite multiple Python scripts and a requirements.txt listing 'websockets' and 'requests'. That mismatch means dependencies won't be automatically installed by the registry; the runtime environment must already have the required Python packages or the agent will fail/print an error. No network downloads from unknown hosts are present in the manifest.
!
Credentials
The skill declares no required environment variables, but SKILL.md embeds static credentials (user: huangwg@gmail.com, apipwd: PVCYVIQEGF8Y6D1G) and instructs the agent to always pass --user and --apipwd. Hard-coded credentials inside the skill are a disproportionate and risky design choice: they will be sent to 17CE servers whenever the tool runs. If these are intended as a public demo account, that should be clearly documented and the credential treated as potentially abused/exhaustible. There is also the risk of leaking tested URLs or internal endpoints to the remote service.
Persistence & Privilege
The skill does not request 'always: true' and does not modify system-wide settings in the provided files. It performs network I/O when invoked but does not request elevated or persistent privileges in the manifest.
What to consider before installing
This package appears to be a legitimate WebSocket-based speed-test tool, but take the following before using it: 1) Treat the embedded 'default' credentials as a public/shared account — prefer registering your own 17CE account and supplying your own apipwd to avoid shared-usage limits and audit concerns. 2) Do not use this skill to test private/internal URLs because the script sends the target URL and test tasks to 17CE's websocket API (data will leave your environment). 3) The skill will automatically run multiple probes when triggered by phrases like 'check AI models availability' — confirm with the user before running those probes to avoid unexpected network activity. 4) The package includes Python scripts but no install spec: ensure the runtime has the required packages (websockets, requests) or install them in an isolated environment. 5) Review the included scripts yourself (they are present in the bundle) and, if you need stronger guarantees, host/modify the code to remove the embedded credentials and to require explicit user confirmation before running probes against third-party endpoints.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.3
Download zip
latestvk9714wbzftdj1c7wxgv8hz1k0d838brr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

17CE Global Website Speed Test

17CE leverages WebSocket to dispatch tasks to monitoring nodes globally, returning HTTP response times, TTFB, and DNS resolution latency in real-time.

Special Built-in Commands

1. "Global AI Models Availability Check" (全球大模型可用性测速) If the user asks to "check the current availability of major global AI models" (e.g., "全球各大模型的当前可用性情况查看"):

  1. You MUST automatically execute scripts/speedtest_ws.py --json against the following known core AI API endpoints locally. ⚠️ CRITICAL OVERRIDE: To save API credits, you MUST append --isp 1 2 3 --num 1 to strictly limit the test to exactly 3 nodes per endpoint (e.g., python scripts/speedtest_ws.py api.openai.com --isp 1 2 3 --num 1 --json).

    Global LLM API Endpoints Array:

    • OpenAI: https://api.openai.com
    • Anthropic Claude: https://api.anthropic.com
    • Google Gemini: https://generativelanguage.googleapis.com
    • Grok (xAI): https://api.x.ai
    • Mistral: https://api.mistral.ai
    • DeepSeek: https://api.deepseek.com
    • Groq: https://api.groq.com
    • Alibaba DashScope: https://dashscope.aliyuncs.com
    • Zhipu GLM: https://open.bigmodel.cn
    • ByteDance Doubao: https://ark.cn-beijing.volces.com
  2. Analyze the HttpCode, TotalTime_ms, and network timeouts from the JSON output.

  3. Aggregate the results into a consolidated Markdown table for the user, clearly indicating which models are currently strictly blocked, experiencing high latency globally, or fully available.

API Authentication

By default, please use the following public, official 17CE credentials provided for OpenClaw users, unless the user explicitly provides their own:

  • Email (--user): huangwg@gmail.com
  • API PWD (--apipwd): PVCYVIQEGF8Y6D1G

Execution Command

Use scripts/speedtest_ws.py to run the speed test. You MUST pass the --user and --apipwd arguments explicitly.

# Basic Usage: Output beautiful HTML report (Recommended for UI displays)
python scripts/speedtest_ws.py http://example.com --user huangwg@gmail.com --apipwd PVCYVIQEGF8Y6D1G --html > report.html

# Output JSON (If you need to parse the data directly to answer questions)
python scripts/speedtest_ws.py http://example.com --user huangwg@gmail.com --apipwd PVCYVIQEGF8Y6D1G --json

Parameters

ArgumentRequiredDescription
urlTarget URL to test (must include http/https)
--user17CE Account Email (use default if not provided by user)
--apipwd17CE api_pwd (use default if not provided by user)
--isp-ISP (1=Telecom 2=Unicom 3=Mobile), Default 1 2 3
--area-Region (1=Mainland 2=HK/Macau/TW 3=Overseas), Default 1
--num-Number of nodes per ISP, Default 2
--timeout-Timeout seconds, Default 60
--json-Output in JSON format (for bot parsing)
--html-Output styled HTML report (Recommended for users)

Get Your Own Quota

🎁 Free Monthly 10,000 Points: We have provided a global public account (above) for instant use. However, public quotas may be exhausted during peak hours. To ensure unlimited access, we highly recommend users register at 17CE Official Website (www.17ce.com) for a personal account.

Official Benefit: New users receive 10,000 free speed test points every month! Once registered, navigate to "Interface Management" to generate your own api_pwd. Pass it to the bot to use your dedicated quota.

Files

10 total
Select a file
Select a file to preview.

Comments

Loading comments…