Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

POWPOW 简化版 - 在 OpenClaw 中轻松创建和管理 POWPOW 数字人

v1.0.0

POWPOW 简化版 - 在 OpenClaw 中轻松创建和管理 POWPOW 数字人。支持用户注册、数字人创建、位置选择和徽章管理。

0· 65·0 current·0 all-time
by度人自度@durenzidu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for durenzidu/powpow-simple.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "POWPOW 简化版 - 在 OpenClaw 中轻松创建和管理 POWPOW 数字人" (durenzidu/powpow-simple) from ClawHub.
Skill page: https://clawhub.ai/durenzidu/powpow-simple
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install powpow-simple

ClawHub CLI

Package manager switcher

npx clawhub@latest install powpow-simple
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the implementation: the skill implements register/login/avatar upload/create/list/renew/searchLocation against a POWPOW API base URL and uses AMap for geocoding. Dependencies (axios, form-data) are appropriate for HTTP requests and multipart uploads. There are no unrelated environment variables or binaries required.
Instruction Scope
SKILL.md commands align with the implemented commands in dist/index.js. The runtime instructions and code only reference the POWPOW API (https://global.powpow.online) and AMap geocode (https://restapi.amap.com) and do not attempt to read unrelated system files or environment variables. The skill does read a user-supplied file path for avatar upload (expected) and stores session context in the provided OpenClaw context (expected).
Install Mechanism
There is no install spec beyond normal npm packaging; the package.json dependencies are standard libraries (axios, form-data) from npm. No downloads from arbitrary URLs or archive extraction are present.
Credentials
The skill declares no required environment variables. It does include default configuration values (a hardcoded AMap key and POWPOW base URL) in DEFAULT_CONFIG; the embedded AMap key is potentially a developer/public key (not a secret requested from the user). The skill stores and uses a POWPOW session token (from successful login) in the agent context, which is appropriate for its functionality.
Persistence & Privilege
The skill includes a configurable logger that can write logs to disk (setLogFile) and README describes default local paths for logs and feedback. Writing logs/feedback to the user's home directory is plausible for this kind of skill, but it means the skill will create files locally if configured or if default behavior is implemented. always is false and the skill does not request elevated privileges or modify other skills.
Assessment
This skill appears to do what it claims (a POWPOW client). Before installing, consider: 1) Network/privacy: the skill will send credentials, avatar files and other data to the POWPOW service (default https://global.powpow.online) and will call AMap for geocoding — only use if you trust those services. 2) Local files: uploadAvatar reads an arbitrary file path you provide; avoid uploading sensitive files. 3) Logs and feedback: the skill can write logs/feedback to disk (configurable logFile or default locations described in README) — if you don't want files written, do not set a logFile and verify whether the skill creates defaults. 4) Hardcoded AMap key: a default AMap key is embedded; you may want to replace it with your own key if needed. 5) If you need stronger assurance, review the package source at the repository URL (https://github.com/durenzidu/powpow-simple.git) and confirm the truncated portions (feedback/logging defaults) before use.
dist/index.js:567
Environment variable access combined with network send.
!
dist/index.js:538
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

avatarvk9787vva12mcd5gad58qvqks5584marbbadgevk9787vva12mcd5gad58qvqks5584marbcreationvk9787vva12mcd5gad58qvqks5584marbdigital-humanvk9787vva12mcd5gad58qvqks5584marblatestvk9787vva12mcd5gad58qvqks5584marbmapvk9787vva12mcd5gad58qvqks5584marbopenclawvk9787vva12mcd5gad58qvqks5584marbpowpowvk9787vva12mcd5gad58qvqks5584marb
65downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

POWPOW Simple Skill

在 OpenClaw 中轻松创建和管理 POWPOW 数字人。

简介

POWPOW Simple 让你可以在 OpenClaw 聊天界面中完成 POWPOW 数字人的完整创建流程。

什么是 POWPOW?

POWPOW(泡泡世界)是一个虚实交融的次元空间,在这里你可以:

  • 创造数字分身,你就是 Ta 的神
  • 让数字人在地图上自由探索
  • 与其他数字生命相遇
  • 开启一段奇妙的旅程

使用方法

开始旅程

/powpow.start

跟随引导完成 POWPOW 之旅。

注册账号

/powpow.register
用户名: your_username
密码: your_password

登录账号

/powpow.login
用户名: your_username
密码: your_password

创建数字人

/powpow.create

按照交互式提示:

  1. 输入数字人名称
  2. 输入描述(可选)
  3. 上传头像(可选)
  4. 选择位置

查看数字人列表

/powpow.list

续期数字人

/powpow.renew
digitalHumanId: 你的数字人ID

搜索位置

/powpow.searchLocation
keyword: 北京故宫

提交反馈

/powpow.feedback
message: 我遇到了一个问题...
contact: 你的联系方式(可选)

徽章系统

  • 🎁 新用户奖励:注册即获得 3 枚徽章
  • 创建数字人:消耗 2 枚徽章
  • 🔄 续期数字人:消耗 1 枚徽章(延长 30 天有效期)

查看你的数字人

创建成功后,访问以下链接在地图上查看你的数字人:

🗺️ https://global.powpow.online/map

配置

在初始化 Skill 时可以传入配置:

{
  powpowBaseUrl: 'https://global.powpow.online',  // POWPOW API 地址
  amapKey: '你的高德地图Key',                      // 高德地图 Web Service Key
  defaultAvatar: 'https://example.com/default.png', // 默认头像
}

依赖

  • POWPOW API - 用户注册、数字人管理
  • 高德地图 API - 地理位置搜索

作者

  • durenzidu - 创建者和维护者

链接


创造数字人,你就是 Ta 的神。

Comments

Loading comments...