Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

RHSkill

v1.0.0

RunningHub AI Platform 直接调用 - 文生图、图生图、视频生成等,支持智能存储判断和链式工作流

0· 113·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for airix315/rhskill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "RHSkill" (airix315/rhskill) from ClawHub.
Skill page: https://clawhub.ai/airix315/rhskill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: RUNNINGHUB_API_KEY
Config paths to check: runninghub.baseUrl
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install rhskill

ClawHub CLI

Package manager switcher

npx clawhub@latest install rhskill
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe direct RunningHub API usage and the code implements a client, task execution, and storage handling — these are coherent. Minor mismatch: registry metadata / SKILL.md declare a required config path 'runninghub.baseUrl' while the code and README use the environment variable RUNNINGHUB_BASE_URL; this inconsistency could cause configuration confusion but does not by itself indicate malicious intent.
Instruction Scope
SKILL.md instructs the agent to set RUNNINGHUB_API_KEY and RUNNINGHUB_BASE_URL and to edit ~/.openclaw/openclaw.json; the code reads that file and the skill directory (references/shared-apps.json). The code also executes system commands (unzip, bdpan, gog) via child_process when handling storage — these steps are related to the 'cloud' storage feature but broaden what the agent will do (filesystem writes, spawning external CLIs). SKILL.md documents bdpan/gog usage but does not explicitly warn that the skill will call those CLIs automatically during cloud uploads.
Install Mechanism
There is no install spec — it's instruction/code-only and nothing is downloaded from arbitrary URLs. The code files are included with the skill; no external package downloads or extract-from-URL steps are present in the manifest.
Credentials
Declared required env: RUNNINGHUB_API_KEY (primary credential) which matches the RunningHub integration. However, the code also relies on RUNNINGHUB_BASE_URL (used by createClientFromEnv) though RUNNINGHUB_BASE_URL is not listed in metadata's required env list — this is an omission. Additionally, storage-handler spawns bdpan/gog CLIs which may use stored credentials or local auth tokens outside the skill; those credentials are not requested by the skill but the skill can cause those tools to run and thus indirectly access user cloud accounts.
Persistence & Privilege
The skill does not request 'always: true' or modify other skills. It reads ~/.openclaw/openclaw.json for its own config and writes/downloads files to output paths and /tmp as part of storage handling — expected for a media-handling skill, but be aware of filesystem writes.
What to consider before installing
This skill appears to implement what it says: a RunningHub API client plus optional cloud upload. Before installing, check these points: (1) Config mismatch — the metadata lists a config path 'runninghub.baseUrl' but the code and README expect RUNNINGHUB_BASE_URL; make sure you set RUNNINGHUB_BASE_URL. (2) The skill will read ~/.openclaw/openclaw.json to merge user app configs — ensure that file does not contain secrets you don't want read. (3) If you use 'cloud' storage the skill runs system commands (unzip, bdpan, gog). Those external CLIs may access your cloud credentials (bdpan/gog) or execute arbitrary binaries on your machine; verify and trust those CLIs first. (4) The skill writes files to /tmp and the configured outputPath. If you do not trust the repository author or the bdpan/gog tools, run the skill in a sandbox or inspect/modify the storage-handler and task-executor code to remove or alter cloud upload behavior. (5) If you want to proceed, export RUNNINGHUB_API_KEY and RUNNINGHUB_BASE_URL and test only with non-sensitive projects until comfortable.
scripts/storage-handler.mjs:71
Shell command execution detected (child_process).
scripts/rh-client.mjs:25
Environment variable access combined with network send.
!
scripts/rh-client.mjs:7
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
EnvRUNNINGHUB_API_KEY
Configrunninghub.baseUrl
Primary envRUNNINGHUB_API_KEY
latestvk974hj5e6s4qghj1r22kajw4pd83vbbk
113downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

RunningHub API Skill

概述

直接调用 RunningHub API,支持生图、生视频、音频处理等 AI 任务。

与 RHMCP 的关系

  • RHMCP 是 MCP Server,提供 STDIO/HTTP 接口
  • 本 Skill 直接复用 RHMCP 的 API Client,跳过 MCP 层,速度更快
  • 支持 RHMCP 配置文件中定义的 APP

前置条件

  1. RunningHub 账号

  2. 百度网盘(可选,用于 cloud 存储)

    • 安装 bdpan-storage Skill
    • 执行登录:bash ~/.agents/skills/bdpan-storage/scripts/login.sh
  3. Google Drive(可选,用于 cloud 存储)

    • 安装 gog Skill
    • 执行授权:gog auth credentials /path/to/client_secret.json

配置

环境变量

export RUNNINGHUB_API_KEY="your-api-key"
export RUNNINGHUB_BASE_URL="www.runninghub.cn"  # 或 www.runninghub.ai

OpenClaw 配置

编辑 ~/.openclaw/openclaw.json

{
  skills: {
    entries: {
      "runninghub-api": {
        enabled: true,
        env: {
          RUNNINGHUB_API_KEY: "your-api-key",
          RUNNINGHUB_BASE_URL: "www.runninghub.cn",
        },
        config: {
          defaultStorage: "auto",      // auto/none/cloud
          defaultCloudProvider: "auto", // auto/bdpan/gog
        }
      }
    }
  }
}

存储模式

模式说明触发条件
none返回 RH 服务器 URL默认、直接交付、链式流程
cloud上传到网盘明确要求保存、需要确认
local下载到本地服务器不适用,禁用

AUTO 决策逻辑

if (storage === "auto") {
  if (链式流程 || 直接交付) → "none"
  else if (要求保存 || 需要确认) → "cloud"
  else → "none"
}

if (cloudProvider === "auto") {
  if (提到 Google/Sheet) → "gog"
  else → "bdpan"
}

路径规则

  • bdpan: runninghub/{projectName}/{timestamp}_{filename}
  • gog: RunningHub/{projectName}/{timestamp}_{filename}
  • 项目名: 用户指定 > 自动生成(rh-{timestamp}

工具

rh_list_apps

列出可用的 RunningHub APP。

rh_list_apps({ refresh: false })
// 返回: { apps: [{ alias, appId, category, description }] }

rh_execute

执行 APP 任务。

rh_execute({
  alias: string,              // APP 别名
  params: Record<string, any>, // APP 参数
  storage?: "none" | "cloud" | "auto",
  cloudProvider?: "bdpan" | "gog" | "auto",
  projectName?: string,       // 项目名称
  mode?: "sync" | "async",    // 同步/异步
  timeout?: number            // 超时时间(秒)
})

// 返回: {
//   taskId: string,
//   status: "SUCCESS" | "PENDING",
//   outputs: [{
//     originalUrl: string,   // RH 服务器 URL
//     cloudUrl?: string      // 网盘 URL(cloud 模式)
//   }]
// }

rh_query_task

查询任务状态(用于异步模式)。

rh_query_task({ taskId: string })
// 返回: { taskId, status, outputs?, progress? }

使用示例

简单生图(none 模式)

用户: 生成一只可爱的猫咪

Agent 调用:
rh_execute({
  alias: "qwen-text-to-image",
  params: { text: "一只可爱的猫咪,卡通风格" },
  storage: "none"
})
// 返回 RH 服务器 URL

上传到百度网盘

用户: 生成一张风景图保存到网盘

Agent 调用:
rh_execute({
  alias: "qwen-text-to-image",
  params: { text: "美丽的风景" },
  storage: "cloud",
  cloudProvider: "bdpan",
  projectName: "landscape"
})
// 返回 bdpan://runninghub/landscape/...

链式流程(图生视频)

用户: 生成主角图片,然后用它生成视频

步骤1: 生成图片(storage: "none")
const imageResult = await rh_execute({
  alias: "qwen-text-to-image",
  params: { text: "主角形象" },
  storage: "none"
});
const imageUrl = imageResult.outputs[0].originalUrl;

步骤2: 图生视频(使用上一步 URL)
rh_execute({
  alias: "image-to-video",
  params: { image: imageUrl, prompt: "奔跑动画" },
  storage: "cloud"
});

共享 APP 清单

内置共享测试 APP(来自 RHMCP 官方):

别名APP ID类型说明
qwen-text-to-image2037760725296357377imageQwen 文生图
qwen-image-to-image2037822548796252162imageQwen 图生图

故障排除

问题原因解决
提交任务失败APP 参数不匹配检查 shared-apps.json 中的 inputs 配置
bdpan 上传失败未登录执行 bash scripts/login.sh 重新登录
任务超时执行时间过长使用 mode: "async" 异步模式
Token 过期授权失效重新登录或授权

扩展开发

添加新 APP

编辑 references/shared-apps.json

{
  "apps": {
    "my-new-app": {
      "appId": "your-app-id",
      "alias": "my-new-app",
      "category": "video",
      "description": "描述",
      "inputs": {
        "param1": { "nodeId": "1", "fieldName": "field1" }
      }
    }
  }
}

参考链接

License

MIT

Comments

Loading comments...