Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clawhub Skill
v1.0.5Generate academic figures and scientific diagrams from paper text using a multi-agent pipeline powered by Alibaba Cloud DashScope (Qwen-VL + Wanxiang/Qwen-Im...
⭐ 0· 59·0 current·0 all-time
byyrjm@zdywrnm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to use Alibaba Cloud DashScope (Qwen-VL / Wanxiang / Qwen-Image) to generate academic figures, which matches the stated purpose. However, both SKILL.md and clawhub.json require an OPENAI_API_KEY (and the sample config uses openai_api_key). Requiring an OpenAI-style key for an Alibaba DashScope integration is unexpected and not explained in the docs — this mismatch is incoherent and worth verifying with the package author or upstream repo.
Instruction Scope
SKILL.md is an instruction-only CLI guide: it tells the user to install an npm package globally and to set an API key (OPENAI_API_KEY) or create a ~/.paperbanana-dashscope config. The instructions do not explicitly ask the agent to read unrelated system files or exfiltrate data. However, the runtime behavior depends entirely on the npm package (not included here), so the instructions alone cannot guarantee what the installed tool will do.
Install Mechanism
There is no install spec in the skill bundle itself (instruction-only). The README recommends npm install -g paperbanana-dashscope from npmjs.com and links a GitHub repo. Using npm and GitHub is a common install path, but global npm installation runs code on the host and may execute install scripts; you should inspect the package on npm/github before installing.
Credentials
Only OPENAI_API_KEY (required) and an optional DASHSCOPE_IMAGE_MODEL are declared. The required credential name (OPENAI_API_KEY) does not clearly match the declared provider (Alibaba DashScope). This raises two concerns: (1) the package may be asking users to reuse sensitive OpenAI keys for an unrelated third-party service, and (2) it may send that key to endpoints outside OpenAI. No other unrelated credentials are requested, but the mismatch is disproportionate and unexplained.
Persistence & Privilege
The skill does not request always: true, does not include install scripts in the skill bundle, and declares no required system config paths. It's user-invocable and allows model invocation (normal). There is no evidence the skill modifies global agent settings itself.
What to consider before installing
Proceed cautiously. Before installing or providing any API key: 1) Inspect the npm package and the linked GitHub repository (look at package.json, install/postinstall scripts, and the code that sends requests). 2) Do not reuse your primary OpenAI API key — create a dedicated key with minimal privileges or use a throwaway/test key. 3) Verify whether DashScope truly accepts an OpenAI-style key or if the package is repurposing your OpenAI key to talk to other services. 4) Prefer installing in a sandbox/container or examining the package source locally instead of installing globally. 5) If you cannot confirm why OPENAI_API_KEY is required for an Alibaba service, contact the package author or avoid installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97e4ydggdh0jx78nj7x2s6x8x84csvx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.