Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cross Platform Bot Builder
v1.0.0跨平台 Bot 生成器。一键生成 Telegram/微信/抖音/Discord Bot，统一 API，多平台部署。Triggers: bot builder, telegram bot, wechat bot, discord bot, multi-platform bot.
⭐ 0· 54·0 current·0 all-time
by@sky-lv
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to generate and deploy bots for Telegram, Discord, WeChat, Douyin, etc., which legitimately requires platform tokens and adapter code. However, the registry metadata lists no required environment variables, no install steps, and no source/homepage. The SKILL.md itself references many platform-specific secrets (TELEGRAM_BOT_TOKEN, DISCORD_BOT_TOKEN, WECHAT_APP_ID/SECRET/AES_KEY, etc.), so the declared requirements are incomplete and inconsistent with the stated purpose.
Instruction Scope
The SKILL.md stays within bot-building scope (project templates, adapters, handlers, deployment). However it instructs use of npx and require() calls (e.g., 'npx bot-builder create' and 'require('@skylv/bot-builder')') which will execute remote/npm-hosted code at runtime — an action outside the passive 'read-only instructions' model and one that can run arbitrary code. Also there is an inconsistency in referenced package names ('bot-builder' vs '@skylv/bot-builder').
Install Mechanism
There is no declared install spec in the registry (instruction-only). But the instructions explicitly suggest running npx and npm-based installs and copying Docker images/build steps. Running 'npx <pkg>' fetches and executes code from the npm registry — a moderate risk if the package name is unverified or typosquat. The skill does not link to a trusted repository or release host.
Credentials
The SKILL.md references many sensitive environment variables and tokens for multiple platforms, yet the skill metadata lists none. Requesting or instructing users to supply multiple platform credentials is expected for a cross-platform bot builder, but the absence of declared required env vars in the registry metadata is an omission that reduces transparency and prevents automated gating/permission checks.
Persistence & Privilege
The skill is not set to always:true and does not request persistent system privileges. As an instruction-only skill it does not install persistent agents itself. Autonomous model invocation is allowed (the platform default) but not combined with other high-privilege flags.
What to consider before installing
Before installing or running this skill: 1) Treat the skill as unverified: there is no source repository or homepage. 2) Do not run suggested npx/npm commands or Docker images on production machines without reviewing the code from the package/registry first — npx executes remote code. 3) The SKILL.md references many platform tokens (Telegram, Discord, WeChat, Douyin, Slack, WhatsApp). Only provide minimal-permission tokens and test accounts; rotate tokens if you later suspect exposure. 4) Verify the exact npm package names and author (typosquat risk: 'bot-builder' vs '@skylv/bot-builder' inconsistency). 5) Prefer cloning a repository you can inspect, run in an isolated environment (sandbox/container), and review adapter implementations for secret handling and outbound network calls before deploying. 6) If you need higher confidence, ask the skill author for a source repo or official package links and a clear list of required env vars.Like a lobster shell, security has layers — review code before you run it.
latestvk976x0q8e75vcsy8tqp30j4a8s84n16s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.