ClawHub

WeryAI Chat

v0.1.0

Chat, ask, compare, and inspect WeryAI chat models through the official OpenAI-compatible chat completions API. Use when you need general assistant chat, mul...

⭐ 0· 96·0 current·0 all-time
by@weryai-developer
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binary (node), and required env (WERYAI_API_KEY) match the included scripts (models.js, write.js) that call the WeryAI chat and models endpoints. The package implements chat completions and model lookup as advertised; there are no unrelated credentials or binaries requested.
ℹ
Instruction Scope
SKILL.md instructs the agent to run the included node scripts (models.js, write.js) and to prefer dry-run when validating payloads. The scripts only read environment variables and call the WeryAI endpoints; they do not attempt to read arbitrary user files or unrelated system state. A pre-scan detected a 'system-prompt-override' pattern, but in context this appears to be the normal inclusion of system messages and presets (systemPrompt strings) that are passed to the remote model — not instructions to override the agent host's system prompt or to exfiltrate data.
✓
Install Mechanism
No install spec or remote download is used. This is an instruction/package bundle containing JS scripts that run with node; no external arbitrary code is fetched at install time.
ℹ
Credentials
The only required credential is WERYAI_API_KEY (declared as primaryEnv), which is appropriate for a client that calls the WeryAI API. The code also reads optional environment variables (WERYAI_BASE_URL, WERYAI_REQUEST_TIMEOUT_MS, WERYAI_TEXT_MODEL) that are not listed in requires.env — this is typical for configuration, but you should verify WERYAI_BASE_URL points to the official API (default is https://api.weryai.com) before setting it.
✓
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and has normal agent-invocation defaults. It does perform network calls to the WeryAI API (network_required: true), which is expected.
Scan Findings in Context
[system-prompt-override] expected: The pattern likely matches the many 'systemPrompt' strings and the skill-level instructions in SKILL.md. Those are used as model system messages passed to the remote chat API and are expected for a chat skill; they do not appear to be an attempt to overwrite the host agent's system prompt or to exfiltrate secrets.
Assessment
This package is coherent with its stated purpose: it needs only a WERYAI_API_KEY and node to run. Before installing, verify you trust the WeryAI API recipient: (1) ensure WERYAI_BASE_URL (if set) points to the official API (default: https://api.weryai.com), (2) prefer running with --dry-run to inspect request payloads without spending credits, and (3) do not supply the API key to untrusted skill sources. The SKILL.md and presets include system-message templates that will shape model responses—this is expected behavior for a chat client, not a hidden instruction to your local agent. If you need stronger assurance, review the scripts/models.js and scripts/write.js invocations locally or run them in an isolated environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ft4f9sdczqq29bqmh7h95ts83dgkt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

💬 Clawdis
Binsnode
EnvWERYAI_API_KEY
Primary envWERYAI_API_KEY

Comments