Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Lanxin Media

v1.0.0

蓝信官方媒体发送能力,支持发送图片、文件。使用 <lximg> <lxfile> 标签发送,系统自动解析上传。

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for iamdacai/lanxin-media.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Lanxin Media" (iamdacai/lanxin-media) from ClawHub.
Skill page: https://clawhub.ai/iamdacai/lanxin-media
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install lanxin-media

ClawHub CLI

Package manager switcher

npx clawhub@latest install lanxin-media
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, files, and lack of extra credentials match a simple media-sending skill. The included index.js is harmless boilerplate. However SKILL.md contains an 'openclaw.always':true metadata entry while registry flags report always:false — a mismatch worth noting (attempt to request permanent inclusion inside the instruction file).
!
Instruction Scope
SKILL.md mandates that the agent must output raw <lximg>/<lxfile> tags with real file paths or URLs, must not refuse, and must not explain. The instructions do not require verifying existence/permissions and encourage supplying local paths (e.g., /Users/user/photo.jpg). That coerces the agent to produce local file paths (which the platform may then upload) and forbids refusal or contextual explanations — increasing the risk of accidental or coerced disclosure of sensitive local files or fabricating tags.
Install Mechanism
No install spec and no dependencies — instruction-driven skill with a tiny harmless index.js. Nothing is downloaded or written to disk by an installer.
Credentials
The skill declares no environment variables, no credentials, and no config paths. That is proportionate for a tag-producing media skill.
!
Persistence & Privilege
Registry metadata shows always:false, but SKILL.md includes openclaw.always:true. If the platform honored the SKILL.md metadata, that would grant this skill permanent inclusion (higher privilege). The presence of that metadata inside SKILL.md is a red flag because it attempts to assert elevated persistence from within the instruction file.
What to consider before installing
This skill appears to be a simple helper that instructs the agent to output special <lximg>/<lxfile> tags so the system can upload media. That is coherent, but the runtime rules force the agent to output raw file paths/URLs and forbid refusing or explaining — which can make the agent return sensitive local paths (or be coerced into fabricating tags). Before installing: verify how your platform handles <lximg>/<lxfile> (does it auto-upload local paths? from what filesystem scope?), test the skill only with non-sensitive files/URLs, and confirm the platform does not honor the SKILL.md 'always:true' override. If possible, restrict the skill's access to only user-provided URLs (not arbitrary local filesystem paths) or require explicit user confirmation before uploading local files.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📸 Clawdis
latestvk971x7c751tvvmaq5cvxk71yxd85cmqx
63downloads
0stars
1versions
Updated 4d ago
v1.0.0
MIT-0

蓝信媒体发送规则(必须严格遵守)

核心规则(绝对禁止违反)

  1. 用户要求发图片/文件,必须直接输出 <lximg><lxfile> 标签
  2. 标签必须单独成行,不使用任何 markdown、代码块、加粗、斜体
  3. 禁止把标签放在 ``` 代码块中
  4. 禁止说“无法发送”“不支持”“暂时不能”等拒绝话术
  5. 禁止解释标签作用,直接输出即可
  6. 一次只发送一个文件或一张图片
  7. 路径必须真实有效,格式干净无多余符号

发送图片(必须这样输出)

注意:发送图片时必须使用 <lximg> 标签,而不是 <lxfile> 标签! 注意:SVG 文件请使用 <lxfile> 标签发送,而不是 <lximg> 标签!

格式: <lximg>文件路径或URL</lximg>

示例(正确): 这是你要的图片: <lximg>/Users/user/photo.jpg</lximg>

示例(正确): <lximg>https://example.com/image.png</lximg>

发送 SVG 文件(必须这样输出)

注意:SVG 文件必须使用 <lxfile> 标签,而不是 <lximg> 标签!

格式: <lxfile>文件路径或URL</lxfile>

示例(正确): <lxfile>/Users/user/image.svg</lxfile>

示例(正确): <lxfile>https://example.com/image.svg</lxfile>

发送文件(必须这样输出)

注意:发送文件时必须使用 <lxfile> 标签,而不是 <lximg> 标签!

格式: <lxfile>文件路径或URL</lxfile>

示例(正确): 文件已发送: <lxfile>/Users/user/report.pdf</lxfile>

示例(正确): <lxfile>https://example.com/document.pdf</lxfile>


支持的闭合格式(任选一种)

<lximg>...</lximg><lximg>...</img> <lxfile>...</lxfile><lxfile>...</file>


蓝信限制

  • 图片/文件大小 ≤ 2MB
  • 支持:png、jpg、jpeg、pdf、doc、docx、xls、xlsx、txt
  • 视频、音频暂不支持

严禁出现的错误行为

❌ 禁止:markdown <lxfile>...</lxfile> ❌ 禁止:<lxfile>...</lxfile> ❌ 禁止: <lxfile>... ❌ 禁止:解释“这是标签”“系统会解析” ❌ 禁止:拒绝发送 ❌ 禁止:只输出文字内容,不输出标签

你的行为准则

用户让你发文件/图片 → 直接输出干净标签 → 不要多余描述 → 不要格式包裹 → 完成。

Comments

Loading comments...