ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Javascript Sdk

v0.1.5

JavaScript/TypeScript SDK for inference.sh - run AI apps, build agents, integrate 150+ models. Package: @inferencesh/sdk (npm install). Full TypeScript suppo...

⭐ 0· 1.4k·5 current·5 all-time
byÖmer Karışman@okaris
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (JavaScript/TypeScript SDK for inference.sh) matches the included SKILL.md and reference files: install and usage examples, agent/tool builder patterns, file upload, streaming, proxy setup, sessions, and React/Next.js integration. Nothing requested (no env vars, no binaries, no installs) is out of scope for a client SDK README.
ℹ
Instruction Scope
The SKILL.md contains many runnable examples that legitimately show reading files (fs.readFileSync, createReadStream), using environment variables (process.env.INFERENCE_API_KEY), uploading local file paths, and building agents that can call tools or execute code. Those are expected for an SDK, but they do instruct operations that access local files, environment secrets, and potentially execute code (internalTools().codeExecution(true) and a delete_file tool example). If an agent were to run these examples verbatim with broad privileges, that could enable sensitive operations — but the examples themselves are consistent with an SDK that exposes these capabilities.
✓
Install Mechanism
No install spec or downloads are present; it's instruction-only documentation recommending 'npm install @inferencesh/sdk' which is expected. No external or unusual URLs for installing code are used within the skill bundle itself.
ℹ
Credentials
The skill metadata declares no required env vars; the docs repeatedly show use of an API key (INFERENCE_API_KEY, inf_... placeholders) and recommend using a server proxy to avoid exposing keys in the browser. That is appropriate for an SDK. There are no unrelated credentials requested. Users should however take care to keep API keys server-side and not embed them into client code.
✓
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent platform privileges or attempt to modify other skills or system settings. The SDK examples show persistent session management (session IDs) but that is a service-level feature, not a skill-level privilege escalation.
Assessment
This bundle is documentation for a JS/TS SDK and is internally consistent. Before installing or using it: 1) Never hard-code your INFERENCE_API_KEY into frontend code — follow the proxy examples to keep keys on the server. 2) Review any code that reads local files or enables 'code execution' or tools that delete files before running them under an agent, and require explicit human approval for destructive actions. 3) Be cautious if you allow an autonomous agent to use the SDK with file-system access or code-execution internal tools — those features are powerful and could be abused if misconfigured. If you need stronger assurance, ask the publisher for a canonical homepage/repository and a verified npm package link before installing in production.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dkqfa5x5xbmpn2xr1q5nrv181db46

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments