Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Zen Koan Daily

v0.1.0

Daily Zen Buddhist koan (禅宗公案) lecture with Chinese ink wash illustration and TTS audio. Generates detailed lecture (origin, background, interpretation, mode...

0· 63·1 current·1 all-time
byTommyYanPS@yumyumtum
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description align with the code: Python scripts generate koans, image prompts, and TTS audio. However the README and script comments reference Google Gemini (imagen-3.0) and instruct setting GEMINI_API_KEY, yet the skill metadata declares no environment variables/credentials. generate_image.py prints a command that runs a script in a different skill path (~/clawd/skills/yumfu/scripts/generate_image.py) rather than invoking an image API itself—this cross-skill dependency is unexpected and not justified in metadata.
!
Instruction Scope
SKILL.md and scripts instruct the agent to run local commands, write files under $HOME/.openclaw and /tmp, and to execute uv run commands via the exec tool. generate_image.py prints an exec command which runs a different skill's script (yumfu) — this delegates image generation outside the skill's own code. SKILL.md also mentions optional web_search without declaring that tool; the LLM is authorized to dynamically generate koans (fine) but the instructions give broad discretion ('LLM generates from classical sources') which could cause it to hallucinate or fabricate translations/attributions. These behaviors stay within the functional domain but include cross-skill execution and vague web-search guidance.
Install Mechanism
No install spec (instruction-only plus small scripts) — lowest install risk. Required binaries listed (python3, edge-tts) match the scripts. README suggests pipx install edge-tts and exporting GEMINI_API_KEY for images but there is no automated download/install step in the registry metadata.
!
Credentials
Registry declares no required env vars, but README and code comments reference Google Gemini and suggest exporting GEMINI_API_KEY for images. That credential is not declared in metadata. The skill attempts to use only local tools (edge-tts) and user filesystem, so additional cloud credentials would be disproportionate unless you accept the README's optional Gemini usage—this mismatch should be clarified.
Persistence & Privilege
always: false and no special privileges requested. The skill writes output under the user's home (~/.openclaw/media/outbound/zen-koan) and updates a local references/progress.json — standard for a user-facing skill. It does not request system-wide changes or modify other skills' config, though it instructs running code from another skill path which may assume that other skill is present.
What to consider before installing
This skill generally does what it says (generate koans, an image prompt, and TTS), but there are several things to check before use: - Clarify Gemini usage: README and generate_image.py mention Google Gemini and suggest exporting GEMINI_API_KEY, but the registry metadata does not declare this credential. If you do not want to provide a Gemini key, confirm how images are generated (the shipped script only prints a prompt/command). - Cross-skill exec: generate_image.py prints a command that calls a generate_image.py under ~/clawd/skills/yumfu/, not the local script. That means image generation may rely on another skill/tool you don't have — verify or adjust the command to use a trusted local image pipeline. - Runtime bug: references/progress.json initially lacks a completed_koans array but generate_koan.py expects progress['completed_koans'] when updating — this can crash or corrupt progress on first run. Inspect and initialize progress.json or patch the script before enabling scheduled runs. - edge-tts is invoked locally (no cloud key) — ensure you trust the package you install (pipx install edge-tts) and run in an isolated environment if you are cautious. - LLM dynamic generation and optional web_search: the skill relies on the LLM to synthesize koans and optionally search the web. If you need strictly canonical or fully-accurate historical text, review generated outputs for fidelity and possible hallucinations. Recommendations: run this skill in an isolated/test environment first, review/patch the generate_image.py command and progress.json initialization, and only provide any cloud API keys (Gemini) if you understand how/where they will be used. If you want to use images but do not want to supply a Gemini key, modify the skill to call a local/approved image generator or remove the external dependency.

Like a lobster shell, security has layers — review code before you run it.

latestvk9726q27wmxk9stat0fsga6h3n848s79

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎋 Clawdis
Binspython3, edge-tts

Comments