ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

TTPOS Agent

v1.0.1

通过 ttpos-agent API 查询 TTPOS 餐饮系统营业数据，生成报表。使用前必须访问 GET /api/v1/query/guide 获取数据查询指南。Use when: 今日营业额、订单统计、支付方式、菜品排行、会员分析、班次汇总、时段分析等。NOT for: 与 TTPOS 数据无关的问题。

⭐ 1· 159·0 current·0 all-time
by@bendaye
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
Name/description say it queries TTPOS via the ttpos-agent API and the only required secret is LIGHT_BRIDGE_API_KEY — this aligns with the stated purpose.
ℹ
Instruction Scope
SKILL.md instructs the agent to fetch a guide, list companies, construct SQL based on that guide, and POST arbitrary SQL to /api/v1/query/execute. That is coherent for a query/reporting tool, but giving the skill ability to compose and execute arbitrary SQL remotely increases data-exfiltration risk; the guidance to suppress raw field names and translate enumerations reduces transparency/auditability of returned results.
✓
Install Mechanism
Instruction-only skill with no install step or downloaded code — minimal installation risk.
ℹ
Credentials
Only LIGHT_BRIDGE_API_KEY is required (plus an optional LIGHT_BRIDGE_URL). That is proportionate to a remote-API query skill. However, the single API key grants whatever access the backend exposes; there is no indication of recommended least-privilege scopes or limits.
✓
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent elevated privileges or modify other skills.
What to consider before installing
This skill is internally consistent (it needs one API key to query TTPOS), but it will construct and execute arbitrary SQL on a remote service (https://claw.doge6.com) whose source/homepage is not provided. Before installing: 1) Verify the backend service and vendor (do you trust claw.doge6.com and the owner?) and prefer an official homepage or source. 2) Only supply an API key that is scoped with least privilege (read-only, limited companies/tenants, short TTL) — do not use high-privilege or cloud-wide credentials. 3) Expect the skill can query any tables the API permits; avoid putting sensitive cross-tenant keys into the skill. 4) Ask the vendor whether the API logs queries and who can access the results; rotate the key if unsure. 5) Consider testing in a non-production tenant first. If you need help verifying vendor origin or how to limit key scope, get that information before enabling the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk977zxjd3d8wfcapxedznhx5d9837f9k

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
EnvLIGHT_BRIDGE_API_KEY
Primary envLIGHT_BRIDGE_API_KEY

Comments