Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

cpbox-spellcheck

v1.0.0

USE FOR spell correction. Returns corrected query if misspelled. Most search endpoints have spellcheck built-in; use this only for pre-search query cleanup o...

0· 147·0 current·0 all-time
byspringmint@sprintmint

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sprintmint/cpbox-spellcheck.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "cpbox-spellcheck" (sprintmint/cpbox-spellcheck) from ClawHub.
Skill page: https://clawhub.ai/sprintmint/cpbox-spellcheck
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install cpbox-spellcheck

ClawHub CLI

Package manager switcher

npx clawhub@latest install cpbox-spellcheck
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name, description, and runtime instructions all describe a simple spellcheck HTTP API. There are no unexpected credentials, binaries, or config paths requested that don't match the stated purpose.
Instruction Scope
Instructions are scoped to issuing HTTP GETs to https://www.cpbox.io/api/x402/spellcheck and handling the x402 payment flow. They do not ask the agent to read local files or system state. Note: the docs suggest using npx @springmint/x402-payment (which runs code fetched from npm) to automate payment signing — this expands runtime behavior beyond simple HTTP requests.
Install Mechanism
There is no declared install spec (instruction-only), which is low-risk. However the Quick Start suggests using npx to fetch @springmint/x402-payment; npx dynamically downloads and executes a package from the npm registry at runtime, which is a moderate-risk operation if you don't trust that package or registry.
Credentials
The skill declares no required environment variables, credentials, or config paths. That is proportionate for an API proxy that uses a separate payment/signing step handled locally.
Persistence & Privilege
always:false (default) and no instructions to modify agent/system configuration. The skill does not request persistent/system-level privileges.
Assessment
This skill is an instruction-only wrapper for a paid external spellcheck API (https://www.cpbox.io) and is internally consistent with that purpose. Before using it: (1) understand you will be making requests to a third-party service and may incur charges via the x402 payment flow; (2) avoid sending sensitive or PII in queries unless you trust the service and its privacy policy; (3) be cautious about using the suggested npx @springmint/x402-payment command because npx will download and execute code from npm — review that package and its source before running; (4) verify the facilitator and API endpoints are genuine if you need to trust payments. If you need stronger assurance, request the skill author provide the x402 client code or an explicit vetted install spec rather than an ad-hoc npx suggestion.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a11r6ndbv5hs0qwvgry2c61838ahv
147downloads
0stars
1versions
Updated 20h ago
v1.0.0
MIT-0

Spellcheck

Paid Spellcheck proxy via x402 pay-per-use (HTTP 402).

Prerequisites: This skill requires x402-payment. Complete the setup steps before first use.

Security: Documentation only — no executable code or credentials. Wallet/keys stay on your machine; never stored here.

Service URLs

RoleDomain
API Providerhttps://www.cpbox.io
Facilitatorhttps://www.cppay.finance

Endpoint (Agent Interface)

GET /api/x402/spellcheck

Payment Flow (x402 Protocol)

  1. First request -> 402 Payment Required with requirements JSON
  2. Sign & retry with PAYMENT-SIGNATURE -> result JSON

With @springmint/x402-payment or x402-sdk-go, payment is automatic.

Quick Start (cURL)

curl -s "https://www.cpbox.io/api/x402/spellcheck" \
  -H "Accept: application/json" \
  -G \
  --data-urlencode "q=artifical inteligence" \
  --data-urlencode "lang=en" \
  --data-urlencode "country=US"

Using with x402-payment

npx @springmint/x402-payment \
  --url "https://www.cpbox.io/api/x402/spellcheck?q=artifical%20inteligence&lang=en&country=US" \
  --method GET

Parameters

ParameterTypeRequiredDefaultDescription
qstringYesQuery to spell check (1-400 chars, max 50 words)
langstringNoenLanguage preference (2+ char language code, e.g. en, fr, de, pt-br, zh-hans). 51 codes supported
countrystringNoUSSearch country (2-letter country code or ALL)

Response Fields

FieldTypeDescription
typestringAlways "spellcheck"
query.originalstringThe input query as submitted
resultsarraySpell-corrected suggestions. May be empty when no correction is found
results[].querystringA corrected version of the query

Example Response

{
  "type": "spellcheck",
  "query": {
    "original": "artifical inteligence"
  },
  "results": [
    {
      "query": "artificial intelligence"
    }
  ]
}

Use Cases

  • Pre-search query cleanup: Check spelling before deciding which search endpoint to call
  • "Did you mean?" UI: Show users a corrected suggestion before running the search
  • Batch query normalization: Clean up user inputs in bulk

Notes

  • Built-in alternative: Web Search and LLM Context have spellcheck=true by default — use this standalone endpoint only when you need the correction before searching
  • Context-aware: Corrections consider the full query context, not just individual words

Comments

Loading comments...