Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
俄罗斯血糖检测设备市场调研（即时版）
v1.0.0俄罗斯血糖检测设备市场调研（即时版）v3.0 —— 基于实战经验重构，整合 Python 脚本化报告生成 + SerpAPI 实时搜索 + ast.literal_eval 智能解析 + Xuanself 10章节标准结构，输出可直接交付的 Word 报告。专为 Russia Country Manager 设计...
⭐ 0· 12·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims real‑time SerpAPI (Yandex+Google) crawling and optional TGStat integration for live data collection, but the included Python scripts are only a local report generator that reads a preexisting JSON file (xuanself_raw_*.json or data/demo.json). There is no code in the provided files that calls SerpAPI or performs HTTP requests. Dependencies (requests, beautifulsoup4, lxml) are declared but not used in the visible code, which is inconsistent with the stated 'real‑time search' purpose.
Instruction Scope
SKILL.md instructs users to provide a SerpAPI key in data/data_sources.json and to run scripts. The instructions do not instruct the agent to read unrelated system files or env vars. However, the documentation implies the skill will perform live network collection; the runtime files only generate reports from local JSON. If the real‑time fetch logic is missing or executed outside these files, that should be made explicit.
Install Mechanism
There is no remote binary/URL install; the install step is a simple pip3 install of common Python packages (requests, beautifulsoup4, lxml, python-docx). This is a low‑risk package install pattern, but users should still review packages and use a virtual environment.
Credentials
The skill declares no required environment variables, yet it needs a SerpAPI key (documented to be placed in data/data_sources.json) and includes a hardcoded TGStat API key inside data/data_sources.json. Storing API keys in repository files is unconventional and risky. The presence of a seemingly real TGStat key (bd9710038...) is unexpected and should be verified — it may be a demo key but could also be a leaked/third‑party credential.
Persistence & Privilege
The skill does not request permanent presence ('always' is false), does not modify other skills, and only reads/writes files within its own skill directory and the output folder. No elevated privileges or automatic autonomous invocation beyond the platform default are requested.
What to consider before installing
What to consider before installing:
- The package appears to be an offline report generator: it reads a local JSON and formats a .md/.docx report. If you expected the skill to perform live web searches, that functionality is not present in the visible scripts — ask the author where the SerpAPI/TGStat fetch code lives.
- Do not paste sensitive API keys into repository files; SKILL.md tells you to place your SerpAPI key in data/data_sources.json — prefer environment variables or a secure secrets store. If you must use data/data_sources.json, keep it out of version control.
- The repo contains a hardcoded TGStat API key. Treat this as suspicious: verify whether it is an intentionally public demo key or a leaked credential; avoid reusing it.
- Run the skill first with data/demo.json (offline sample) inside an isolated environment (virtualenv or sandbox) to verify behavior and outputs. Inspect the code paths for any hidden network calls before adding your own keys.
- If you require live data collection, request the missing fetcher module or a clear explanation of how SerpAPI/TGStat integration is implemented.
What would change this assessment: seeing the actual data‑collection code (the module that calls SerpAPI/TGStat), or an explicit note explaining why network fetching is omitted and how keys are handled securely, would raise confidence and could move this to 'benign'.Like a lobster shell, security has layers — review code before you run it.
latestvk97a4j6dgyjfrs146vwpqhxvyh84hxnf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3, pip3