Security checks across malware telemetry and agentic risk
CloudQ appears to be a real Tencent Cloud Advisor helper, but it uses powerful cloud credentials and includes under-disclosed setup behavior that should be reviewed before installation.
Install only if you are comfortable granting Tencent Cloud credentials that may perform CAM, STS, Advisor, and tag-related operations. Use least-privilege or temporary credentials, avoid storing long-lived AK/SK values in shell profiles, review the exact policies before creating the advisor role, and avoid running the environment check or PNG conversion in sensitive environments until the unpinned npx fallback, runtime installs, and TLS fallback are fixed.
def _get_version_via_npx(slug: str) -> str | None:
"""L3: 通过 npx 临时下载 clawhub 执行（无需全局安装，需要 Node.js）"""
import subprocess
result = subprocess.run(
["npx", "--yes", "clawhub@latest", "inspect", slug, "--json"],
capture_output=True, text=True, timeout=60,
)from playwright.sync_api import sync_playwright
except ImportError:
print(" ℹ️ Playwright 未安装，尝试安装...")
subprocess.run([sys.executable, '-m', 'pip', 'install', 'playwright'], check=True, capture_output=True)
subprocess.run([sys.executable, '-m', 'playwright', 'install', 'chromium'], check=True, capture_output=True)
from playwright.sync_api import sync_playwrightexcept ImportError:
print(" ℹ️ Playwright 未安装，尝试安装...")
subprocess.run([sys.executable, '-m', 'pip', 'install', 'playwright'], check=True, capture_output=True)
subprocess.run([sys.executable, '-m', 'playwright', 'install', 'chromium'], check=True, capture_output=True)
from playwright.sync_api import sync_playwright
with sync_playwright() as p:from selenium.webdriver.chrome.options import Options
except ImportError:
print(" ℹ️ Selenium 未安装，尝试安装...")
subprocess.run([sys.executable, '-m', 'pip', 'install', 'selenium'], check=True, capture_output=True)
from selenium import webdriver
from selenium.webdriver.chrome.options import Options65/65 vendors flagged this skill as clean.