Skill flagged โ€” suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AB Agents Meter Reader

v1.0.2

๐Ÿ“Š Read meter readings from photos. Electricity (day/night tariffs) and water meters. Saves history and generates messages for landlord.

โญ 0ยท 50ยท0 currentยท0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for alexburrstudio/ab-agents-meter-reader.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "AB Agents Meter Reader" (alexburrstudio/ab-agents-meter-reader) from ClawHub.
Skill page: https://clawhub.ai/alexburrstudio/ab-agents-meter-reader
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ab-agents-meter-reader

ClawHub CLI

Package manager switcher

npx clawhub@latest install ab-agents-meter-reader
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report โ†’
OpenClawOpenClaw
Suspicious
medium confidence
โ„น
Purpose & Capability
The name/description (meter reading from photos) matches the code and SKILL.md: the script analyzes images with a MiniMax vision tool, saves history, and formats messages. However, the skill does not declare required runtime artifacts (it uses the 'uvx' tool and python3 and expects a MINIMAX_API_KEY) in the registry metadata, which is inconsistent with its actual needs.
!
Instruction Scope
SKILL.md instructs use of MiniMax and installing AB-Agents-Vision-MiniMax, and the script calls a local MCP client ('uvx minimax-coding-plan-mcp') with JSON prompts and images. The script also attempts to source /root/.openclaw/.minimax-env (an absolute path outside the skill's directory) which could cause the agent to read unrelated environment/configuration. The instructions and code rely on MINIMAX_API_KEY but the registry lists no required env vars โ€” this mismatch is significant.
โœ“
Install Mechanism
No install spec is present (instruction-only + a shell script). That minimizes install-time risk because nothing is automatically downloaded or written during installation. The runtime does call external binaries (uvx, python3) but they are not installed by the skill.
!
Credentials
The script requires MINIMAX_API_KEY at runtime (and SKILL.md calls this out), but the skill metadata declares no required env vars. It also sources /root/.openclaw/.minimax-env which may expose other secrets or tokens stored by the platform or other skills. Requesting the vision API key is proportionate to the stated purpose, but silently reading an absolute platform path is not justified by the meter-reading goal.
!
Persistence & Privilege
The skill does not request 'always: true' and writes only to a per-user config directory (~/.meter-readings), which is reasonable. The concern is the script's attempt to source a root-level OpenClaw env file (/root/.openclaw/.minimax-env) โ€” that reads platform-level state belonging to the agent environment and could leak unrelated credentials. The skill does not modify other skills but it does access a config path outside its scope.
What to consider before installing
This skill appears to do what it says (use a vision API to read meter photos and store readings), but there are a few red flags you should address before installing or running it: - It requires a MINIMAX_API_KEY at runtime even though the registry metadata lists no required env vars. Make sure you supply only the expected vision API key and not broader credentials. - The script attempts to source /root/.openclaw/.minimax-env. Inspect that file's contents before running the script (it may contain other tokens or secrets). If you don't control that file or it contains unrelated secrets, do not run the script as root. - The script invokes an external binary 'uvx minimax-coding-plan-mcp' and relies on python3; confirm what 'uvx' is, where it comes from, and that it is the official client for the MiniMax tool you trust. If unsure, run the skill in a sandbox or on a throwaway account. - Because the metadata doesn't declare required env vars or binaries, consider requesting the author to explicitly list MINIMAX_API_KEY and required binaries (uvx, python3) in the skill manifest before use. If you want to proceed safely: inspect meter-reader.sh line-by-line, verify /root/.openclaw/.minimax-env contents (or remove that sourcing line), ensure uvx is trusted, and run the script as an unprivileged user with only the vision API key available in a controlled environment.

Like a lobster shell, security has layers โ€” review code before you run it.

latestvk976rzv15ppjbfty4zgbfxwj4s85jsk9
50downloads
0stars
3versions
Updated 1d ago
v1.0.2
MIT-0

AB Agents Meter Reader ๐Ÿ“Š

Read meter readings from photos โ€” electricity and water meters.

Features

  • โšก Read electricity meters (single or dual tariff)
  • ๐Ÿ’ง Read water meters (hot and cold)
  • ๐Ÿ“ Save readings history with dates
  • ๐Ÿ“จ Generate message for landlord
  • ๐Ÿ”„ Track multiple apartments

Setup

Requirements

  • MiniMax Token Plan API key (for vision)
  • Linux/macOS

Quick Start

# First run - it will ask questions
./meter-reader.sh

# Later runs - just send photos
./meter-reader.sh photo.jpg

First Run Setup

The script will ask:

  1. Tenant name โ€” your name
  2. Apartment address โ€” full address
  3. Meter layout โ€” how to tell meters apart:
    • "left=hot,right=cold" (default)
    • Or custom description

Supported Meter Types

Electricity

  • Single tariff
  • Dual tariff (day/night) โ€” T1=day, T2=night
  • Multi-tariff (cycle through screens)

Water

  • Cold water (usually on left)
  • Hot water (usually on right)
  • Cubic meters (mยณ)

Usage

# Interactive mode (asks for photo)
./meter-reader.sh

# With photo
./meter-reader.sh /path/to/meter.jpg

# Generate message for landlord
./meter-reader.sh --message

How It Works

  1. Analyzes photo using MiniMax VL API
  2. Identifies meter type automatically
  3. Reads the numbers
  4. Saves to readings history
  5. Generates formatted message

History

Readings saved to: ~/.meter-readings/history.json

Format:

{
  "apartments": {
    "address": {
      "tenant": "Name",
      "layout": "left=hot,right=cold",
      "readings": [
        {"date": "2026-04-26", "electricity_day": 8495, "electricity_night": 3008, "water_cold": 423, "water_hot": 240}
      ]
    }
  }
}

Troubleshooting

IssueSolution
Wrong numbersCheck meter photo quality, ensure numbers are clear
Can't identify meter typeName photo file: electricity.jpg, water.jpg
Vision errorCheck MINIMAX_API_KEY is set

AB-Agents ๐Ÿฆ€

Requirements

๐Ÿ‘๏ธ AB Agents Vision (MiniMax) โ€” Required for image analysis. Install first:

clawhub install AB-Agents-Vision-MiniMax

AB-Agents ๐Ÿฆ€

Comments

Loading comments...