Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Chatbot Engine

v1.0.0

智能对话引擎 - 多轮对话与意图识别 | Chatbot Engine - Multi-turn dialogue and intent recognition

0· 206·1 current·1 all-time
byLv Lancer@kaiyuelv

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kaiyuelv/chatbot-engine.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Chatbot Engine" (kaiyuelv/chatbot-engine) from ClawHub.
Skill page: https://clawhub.ai/kaiyuelv/chatbot-engine
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install chatbot-engine

ClawHub CLI

Package manager switcher

npx clawhub@latest install chatbot-engine
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe a multi-turn chatbot and the included Python modules implement exactly that (dialogue manager, intent classifier, KB, LLM adapter). The included LLMAdapter (openai/anthropic/local/mock) and knowledge-base/vector logic align with the stated purpose.
Instruction Scope
SKILL.md gives only standard usage/installation instructions (pip install -r requirements.txt and usage examples). It doesn't instruct the agent to read unrelated files or exfiltrate data. Runtime code does perform file I/O (save/load sessions, save/load KB/intents) which is expected for this purpose.
!
Install Mechanism
There is no install spec beyond 'pip install -r requirements.txt'. The requirements.txt does not include packages that the code imports (e.g., sentence_transformers and fuzzywuzzy are used but not listed). That mismatch may cause runtime failures or unexpected manual installs. No remote downloads are present, but missing deps increase friction and hidden manual steps.
!
Credentials
The skill declares no required environment variables, but LLMAdapter reads provider-specific env vars like OPENAI_API_KEY / ANTHROPIC_API_KEY (os.getenv(f"{provider.upper()}_API_KEY")). Those keys are not declared in metadata. The adapter will call external LLM providers if provided API keys are available — this is expected for a chatbot but the omission in declared env requirements is a transparency/regression issue and could lead to accidental exposure of keys if the agent supplies them.
Persistence & Privilege
Skill does not request always:true and does not modify other skills or system-wide agent settings. It stores/loads sessions and KB under paths provided by callers; that is normal for this kind of skill.
What to consider before installing
This package largely implements a local chatbot, but review and proceed cautiously: - Missing declared env vars: The LLM adapter will read env vars like OPENAI_API_KEY or ANTHROPIC_API_KEY if you initialize with those providers; these were not listed as required. Do not install or run the skill with sensitive API keys in your environment unless you trust it. - Missing dependencies: The code imports sentence_transformers and fuzzywuzzy, but requirements.txt does not list them. Either add those to requirements.txt or run in 'mock' or 'local' mode to avoid installing them. Unexpected manual dependency installation increases risk if you copy commands from third-party sources. - Network calls and data flow: If you configure provider='openai' or 'anthropic' the adapter will use the respective client libraries to call external APIs and send prompts/context. That means user messages and context can be transmitted to those services — expected for a chatbot but important to know for sensitive data. - Run in a sandbox first: Execute unit tests and examples in an isolated environment (virtualenv/container) and try provider='mock' to observe behavior without network calls. - If you need to use production LLMs, explicitly set and scope API keys and audit network usage; consider adding explicit declarations to requirements and SKILL.md documenting env var names and what will be transmitted. - If you want to be stricter: update requirements.txt to include sentence_transformers and fuzzywuzzy (or modify code to optionally import them), and document the env vars the adapter will read. If you cannot verify these, treat the package as untrusted code and do not provide real API keys or sensitive data.

Like a lobster shell, security has layers — review code before you run it.

latestvk976y3pyqb2jfzg7nb1y8dwgpx834fxn
206downloads
0stars
1versions
Updated 9h ago
v1.0.0
MIT-0

Chatbot Engine - 智能对话引擎

企业级对话系统解决方案,支持多轮对话、意图识别、上下文管理和知识库检索。

核心功能

功能模块说明
意图识别基于规则/机器学习的意图分类
实体抽取命名实体识别(人名、地点、时间等)
多轮对话上下文感知的多轮交互
知识库检索基于向量检索的知识问答
对话管理对话状态跟踪和流程控制

快速开始

from scripts.dialogue_manager import DialogueManager

# 创建对话管理器
bot = DialogueManager()

# 处理用户输入
response = bot.process("我想预订明天北京的酒店")
print(response)

安装

pip install -r requirements.txt

项目结构

chatbot-engine/
├── SKILL.md                 # Skill说明文档
├── README.md                # 完整文档
├── requirements.txt         # 依赖列表
├── scripts/                 # 核心模块
│   ├── dialogue_manager.py  # 对话管理器
│   ├── intent_classifier.py # 意图分类器
│   ├── entity_extractor.py  # 实体抽取器
│   └── knowledge_base.py    # 知识库
├── examples/                # 使用示例
│   └── basic_usage.py
└── tests/                   # 单元测试
    └── test_chatbot.py

Comments

Loading comments...