Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Get Ali Searches

v1.0.0

Retrieve a list of related Alibaba Cloud search queries by providing the ALIYUN_RPA_RobotId parameter.

0· 68·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xnlc-qft/get-ali-searches.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Get Ali Searches" (xnlc-qft/get-ali-searches) from ClawHub.
Skill page: https://clawhub.ai/xnlc-qft/get-ali-searches
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install xnlc-qft/get-ali-searches

ClawHub CLI

Package manager switcher

npx clawhub@latest install get-ali-searches
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name and description claim to return Alibaba Cloud-related search queries given an ALIYUN_RPA_RobotId. The SKILL.md also requests a robotId parameter and shows the expected output, so the high-level purpose is consistent. However, the skill does not explain how it obtains the data (no API endpoint, no service host, and no declared credentials), which is an omission.
Instruction Scope
The instructions are narrowly scoped: they tell the agent to invoke an mcp tool with a robotId parameter and return a list. They do not instruct the agent to read arbitrary system files, environment variables, or send data to unrelated endpoints.
Install Mechanism
Instruction-only skill with no install spec or code files. Nothing will be written to disk or installed by the skill itself.
!
Credentials
SKILL.md explicitly requires a robotId (referred to as ALIYUN_RPA_RobotId), but the registry metadata lists no required environment variables or primary credential. This mismatch is concerning: either the robotId is a runtime parameter (fine) or it is a secret/credential that should have been declared. The skill also comes from an unknown source with no homepage, which increases the risk when supplying any identifier that might act as auth.
Persistence & Privilege
The skill does not request persistent presence (always is false), does not modify config paths, and has no install-time components. Autonomous invocation is allowed (platform default) but not combined here with any broad privileges.
What to consider before installing
This skill is small and looks like it does what it says, but it leaves out important details. Before installing or using it: 1) Ask the author to clarify what 'mcp' calls (the exact API endpoint or service) and where network traffic goes. 2) Confirm whether ALIYUN_RPA_RobotId is merely a non-sensitive runtime identifier or an auth token; if it is sensitive, the skill metadata should declare it as a required credential. 3) Because the skill has no listed source or homepage, treat it as untrusted: avoid supplying sensitive credentials, test it in an isolated account/environment, and request more explicit documentation (endpoints, data handling, and provenance) before use.

Like a lobster shell, security has layers — review code before you run it.

latestvk97em02fym512kdmtgjdntscxx84zad9
68downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

获取相关搜索

用途:获取阿里云相关搜索

调用

使用mcp调用此工具,需要提供以下参数:

参数默认说明
robotId必填使用ALIYUN_RPA_RobotId

输出结构

  • 返回列表结构
[
    "阿里云官网登录入口",
    "阿里云游戏服务器",
    "阿里云控制台",
    "阿里云轻量云服务器",
    "阿里云域名注册",
    "阿里云免费服务器",
    "阿里云域名购买",
    "云服务",
    "阿里云和腾讯云哪个好",
    "中国十大云计算公司排名",
]

Comments

Loading comments...