Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Alicloud Ai Search Milvus
v1.0.3Use AliCloud Milvus (serverless) with PyMilvus to create collections, insert vectors, and run filtered similarity search. Optimized for Claude Code/Codex vec...
⭐ 0· 1k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's described purpose (use AliCloud Milvus via PyMilvus to create collections, insert vectors, and search) aligns with the included code and SKILL.md examples. However, the registry metadata does not declare any required environment variables/credentials even though the skill clearly needs MILVUS_URI and MILVUS_TOKEN to function.
Instruction Scope
SKILL.md and scripts limit actions to connecting to a Milvus instance, creating collections, inserting sample vectors, and performing searches. The workflow explicitly suggests confirming intent and running a read-only query first. It does include mutating steps (create/insert) which are expected for this purpose but should be noted before granting access.
Install Mechanism
No install spec — instruction-only with a small Python script. This is low-risk from an installation/download perspective; dependencies (pymilvus) are installed via pip per instructions, which is typical.
Credentials
Although requiring a Milvus URI and token is reasonable for this skill, the registry metadata does not declare these required environment variables or a primary credential. The SKILL.md and script require MILVUS_URI and MILVUS_TOKEN (sensitive credentials). The omission in metadata and the use of a raw token (username:password) is a configuration/information mismatch that increases risk if users are not aware before granting credentials.
Persistence & Privilege
The skill does not request permanent presence (always:false), does not modify other skills, and does not declare elevated platform privileges. It writes output artifacts locally per SKILL.md, which is normal for this type of tool.
What to consider before installing
This skill appears to be what it says (connects to Milvus and runs create/insert/search), but the package metadata failed to declare the sensitive environment variables the code actually requires. Before installing or running it: 1) do not supply admin or wide-scope credentials — use a low-privilege/read-only token for initial testing; 2) verify the MILVUS_URI and MILVUS_TOKEN are intended for this environment (avoid reuse of general account credentials); 3) review scripts/quickstart.py locally (it only uses pymilvus and prints/saves outputs) and run it in an isolated/test environment or container; 4) confirm where output files will be stored and ensure they are not auto-uploaded anywhere; 5) ask the publisher for source/homepage and request that the skill metadata be updated to explicitly declare required env vars and credential scopes. If you cannot verify the source or cannot limit token permissions, do not provide credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk97c8mmqmhjcf5ta94jtea4fc982qvmd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.