Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

PaleBlueDot CLI

v1.0.1

Command-line tool for PaleBlueDot AI platform supporting login, API token management, usage and balance queries, and browsing available AI models.

0· 106·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for derekdong-star/pbd-cli.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "PaleBlueDot CLI" (derekdong-star/pbd-cli) from ClawHub.
Skill page: https://clawhub.ai/derekdong-star/pbd-cli
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install pbd-cli

ClawHub CLI

Package manager switcher

npx clawhub@latest install pbd-cli
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes a CLI for authentication, token management, usage queries, and model browsing — that matches the stated purpose. However, the SKILL.md metadata lists a required binary (pbd-cli) while the registry metadata reported no required binaries; this mismatch suggests the registry record and runtime instructions are not fully synchronized.
Instruction Scope
The instructions stay within the CLI's domain: they describe browser-based OAuth callback, a local HTTP server for the callback, manual cookie entry, token and usage commands, and local config storage. The skill does not instruct reading unrelated system files or grabbing arbitrary environment variables. The manual-login flow does ask the user to paste a session cookie (user-supplied data).
!
Install Mechanism
Although there is no formal install spec in the registry, the SKILL.md includes a One-click Install that pipes a script from raw.githubusercontent.com into bash (curl ... | bash) and installs to /usr/local/bin. Download-and-execute from a remote script is high-risk: while GitHub raw is a common host, piping to bash executes remote code without a local inspection step and can modify system paths. The SKILL.md does not show the install script contents or provide checksums or signed releases.
Credentials
The skill declares no required environment variables or primary credential, which aligns with a client CLI that performs interactive login. It will, however, store session tokens/config locally and manages API tokens — users should expect secrets (session cookies/API keys) to be written to local config. No unrelated credentials are requested.
Persistence & Privilege
always:false and normal autonomous invocation are set (no elevated platform privilege). The install instructions propose placing a binary in /usr/local/bin, which is a persistent, system-wide location and may require elevated permissions; the skill does not ask to modify other skills or system configs beyond installing its binary.
What to consider before installing
This skill appears to do what it claims, but exercise caution before installing. Do not blindly run the suggested curl | bash installer: inspect the install.sh contents and verify the GitHub repository and release artefacts (checksums/signatures) yourself. Prefer downloading an audited release or using a package manager if available. Be aware the CLI stores session cookies/API tokens locally (check the config path and file permissions). If you must use manual login, avoid pasting sensitive cookies into untrusted environments. If you want lower risk, ask the vendor for signed releases or a package that can be inspected before execution, or run the install inside a disposable VM/container.

Like a lobster shell, security has layers — review code before you run it.

latestvk9711mav36dv9pycgth04r85kx845x4w
106downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

Authentication

login (Browser Mode)

Default method, automatically opens browser for OAuth login.

pbd-cli login                      # Browser login (default)
pbd-cli login --port 8085          # Specify callback port
pbd-cli login --base-url https://open.palebluedot.ai

Flow Description:

  1. Starts local HTTP server listening for callback (port 8080-8090 auto-select)
  2. Opens browser to https://www.palebluedot.ai/login?redirect_uri=http://localhost:{port}/callback
  3. Waits for browser callback (5 minute timeout)
  4. After successful callback, calls API to exchange for session
  5. Saves configuration locally

Successful Login Output:

Opening browser for login...
If browser doesn't open, visit: https://www.palebluedot.ai/login?redirect_uri=...
Waiting for login...
Exchanging token for session...
Login successful! Logged in as user ID: 12345

login --manual (Manual Mode)

Manually enter session cookie and user ID.

pbd-cli login --manual

Prompts for input:

  • Session Cookie: Session cookie from browser (format: session=xxx)
  • User ID: User ID (number)

logout

Log out and clear local session.

pbd-cli logout

Token Management

token list

List all tokens.

pbd-cli token list        # Raw JSON output

Output fields:

FieldDescription
IDToken ID
NAMEToken name
QUOTARemaining quota
USEDUsed quota
MODELSAvailable model restrictions
STATUSStatus (enabled/disabled)

token create

Create a new token.

pbd-cli token create --name <name>
pbd-cli token create --name prod-key --quota 100000 --models gpt-4o,claude-3-5
ParameterDescription
--nameToken name (required)
--quotaRemaining quota (default: unlimited)
--expiresExpiration timestamp
--modelsModel whitelist (comma-separated)

token delete

Delete a token.

pbd-cli token delete <id>

token get-key

Get the plaintext key for a token.

pbd-cli token get-key <id>
pbd-cli token get-key <id> -f  # Formatted output

Usage Queries

usage balance

Query balance and subscription status.

pbd-cli usage balance        # Raw JSON output

Output:

  • Quota: Total quota
  • Used: Used quota
  • Remaining: Remaining quota
  • Subscription: Subscription info

usage logs

Query usage logs.

pbd-cli usage logs
pbd-cli usage logs --limit 50 --model gpt-4o
pbd-cli usage logs --page 2 --token my-token
ParameterDescription
--limitItems per page (default: 20)
--pagePage number (default: 1)
--modelFilter by model
--tokenFilter by token name

Wallet Balance

wallet

Query wallet balance.

pbd-cli wallet        # Raw JSON output

Output:

  • Balance: Account balance
  • Gift Balance: Gift balance

Model Browsing

models list

List available AI models.

pbd-cli models list        # Raw JSON output

Common Error Handling

session expired

Error: session expired — please run 'pbd-cli login'

Solution: Run pbd-cli login again to re-authenticate.

Browser Cannot Open

If automatic browser opening fails, the CLI will print the login URL. Open it manually in your browser:

Warning: failed to open browser: ...
Please open this URL manually: https://www.palebluedot.ai/login?redirect_uri=...

Login Timeout

Default wait time is 5 minutes. If timeout occurs, run pbd-cli login again.

Authentication Failed (Manual Mode)

Ensure:

  1. Session cookie format is correct (includes session=xxx)
  2. User ID is correct (pure number)
  3. Base URL is correct (if using custom deployment)

Callback Port Occupied

If default port range (8080-8090) is occupied, use --port to specify a port:

pbd-cli login --port 9000

Configuration File

Configuration file is stored at ~/.pbd-cli/config.yaml with 0600 permissions (owner read/write only).

Configuration Structure:

base_url: https://www.palebluedot.ai
cookie: session=xxx
user_id: 12345
api_key: ""  # Optional
FieldDescription
base_urlAPI base URL
cookieSession cookie for authentication
user_idUser ID
api_keyAPI Key (optional)

Security Note: Configuration file uses 0600 permissions to ensure only the current user can read sensitive information.

Comments

Loading comments...