ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

unisk_video_notification

v1.0.0

向指定手机号发送视频通知（基于 IVVR 平台）。需要提供服务器上已存在的视频文件绝对路径，文件大小不超过 5MB。

⭐ 0· 72·0 current·0 all-time
byZhangKai@zhu-xiao-di

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhu-xiao-di/video-notification.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "unisk_video_notification" (zhu-xiao-di/video-notification) from ClawHub.
Skill page: https://clawhub.ai/zhu-xiao-di/video-notification
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-notification

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-notification
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the behavior: the SKILL.md documents calling a POST /send_video_notice on a user-provided service. Required env vars (API_BASE_URL, API_KEY) are exactly what such a proxy would need and no unrelated credentials or binaries are requested.
ℹ
Instruction Scope
Instructions stay within the expected scope (extract phone numbers and file_path from conversation and call the configured endpoint). Note: the doc references a deployable server script send_video_api.py which is not included here — the user must deploy their own server. The skill does not instruct the agent to read local files or other system secrets; it only forwards a file path string to the remote API.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files - lowest install risk. There is nothing downloaded or written to disk by the skill itself.
✓
Credentials
Only two env vars are required (API_BASE_URL and API_KEY), which are proportional and necessary for calling the user's HTTP service. No unrelated secrets or config paths are requested.
✓
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. Model invocation is allowed (default), which is expected for an agent skill.
Assessment
This skill delegates sending video notifications to an HTTP service you must run. Before installing: (1) Verify API_BASE_URL points to a server you control (not an unknown third party). The skill will send X-API-Key to that URL, so keep API_KEY secret and only give it to trusted endpoints. (2) Deploy and review the referenced server code (send_video_api.py) yourself — ensure it enforces the 5 MB limit, validates file paths, and restricts which filesystem locations can be read to avoid exposing sensitive files. (3) Use HTTPS and firewall/ACLs to limit access to the service. (4) Be cautious when the agent auto-extracts parameters from chat — confirm phone numbers and file paths before sending. If you cannot audit the server code or you must call an external provider, treat the API_KEY and phone data as sensitive and only proceed with a trusted provider.

Like a lobster shell, security has layers — review code before you run it.

latestvk9741e0vkp4ephhtck07sh1d4985ds58
72downloads
0stars
1versions
Updated 4d ago
v1.0.0
MIT-0
ZhangKai@zhu-xiao-di
latest
Download

视频通知发送技能

该技能调用你部署的 FastAPI 视频通知服务，向指定手机号发送视频通知。

前置条件

  1. 已部署视频通知服务（代码见 send_video_api.py）到一台公网可访问的服务器（或使用 ngrok 临时暴露）。
  2. 服务已设置 SERVICE_API_KEY 环境变量，并开放 8867 端口（或通过 Nginx 代理到公网）。
  3. 技能所需的环境变量 API_BASE_URL 和 API_KEY 已在 ClawHub 中正确配置。

使用说明

在对话中提及“发视频通知”或类似关键词，技能会自动提取参数并调用接口。你也可以直接提供 JSON 格式参数。

示例对话

  • 用户：给 15600766391 发视频通知，视频文件在 /home/ubuntu/videos/notice.mp4
  • 技能：调用接口，返回发送结果。

注意事项

  • 视频文件必须预先存在于服务端，且服务进程有读取权限。
  • 文件大小不得超过 5 MB。
  • 手机号格式为 11 位数字，以 1 开头。
  • 如果服务部署在公网，建议配置 HTTPS 以保证 API Key 安全传输。

Comments

Loading comments...