Ai Intelligent Chatbot Builder

聊天机器人，可视化配置 + 多渠道部署。

Security Scan

The skill's description matches a chatbot product, but its runtime instructions tell you to clone and execute an external GitHub repository (and pip install its dependencies) while declaring no required credentials or install steps in the registry — this mismatch and the implicit execution of unvetted code are concerning.

Purpose & Capability

The name/description (visual chatbot builder + multi-channel deployment) aligns with the provided README-style content. However, the skill metadata declares no required environment variables or install steps, while the SKILL.md instructs cloning and running a full application that will likely need channel credentials (WeChat/钉钉), hosting configuration, and other secrets. The lack of declared requirements is an omission.

Instruction Scope

SKILL.md instructs users to run: git clone https://github.com/openclaw-skills/ai-intelligent-chatbot-builder; pip install -r requirements.txt; python app.py. Those commands will download and execute third-party code on the user's machine and install arbitrary PyPI packages. The instructions do not list the credentials, config files, or external endpoints the app will use, so the agent/user following them could expose secrets or run unexpected network activity.

Install Mechanism

Although the GitHub URL uses a mainstream host (moderate trust), the skill has no formal install spec in the registry and provides an ad-hoc install flow in SKILL.md. pip install -r requirements.txt may pull arbitrary packages from PyPI. Because the skill effectively instructs installing and running unreviewed code, the install mechanism is higher-risk than an instruction-only skill that performs no downloads.

Credentials

The registry lists no required environment variables or credentials, yet the described capabilities (multi-channel deployment to Web/WeChat/钉钉) normally require API keys, tokens, or webhook secrets. This mismatch suggests the SKILL.md omits important declarations and could lead to ad-hoc requests for sensitive credentials at runtime.

Persistence & Privilege

The skill does not request always: true, has no declared config paths, and the registry metadata does not ask for persistent system privileges. The main concern is executing external code rather than privileged persistence or automatic enablement.

What to consider before installing

This skill tells you to download and run a GitHub project and pip-install its dependencies but does not declare the credentials or config it will need. Before installing or running it: 1) Inspect the GitHub repository and its code (especially requirements.txt, setup files, and any scripts that read environment variables or make network calls). 2) Verify the publisher and repository authenticity (is the GitHub org legitimate?). 3) Run the app in an isolated environment (container or VM) and never as root. 4) Review dependencies for malicious or high-risk packages. 5) Expect to need API keys for WeChat/DingTalk/webhooks — don't supply secrets until you confirm why they're needed and where they are stored/sent. 6) Prefer a skill that declares its required env vars and an install spec in the registry. If you cannot or will not audit the repository, avoid running it on sensitive hosts.

AI 智能聊天机器人构建器

描述

聊天机器人，可视化配置 + 多渠道部署。

功能

• 可视化配置（拖拽式）
• 多渠道部署（Web/微信/钉钉）
• NLU 理解（意图识别）
• 对话管理（多轮对话）
• 数据分析（对话统计）

定价

• 基础版：¥299/月（1 机器人）
• 专业版：¥1499/月（10 机器人）
• 企业版：¥4999/月（无限机器人）

适用场景

• 智能客服
• 智能助手
• 业务咨询
• 自动问答

技术栈

• Python + FastAPI
• NLU 引擎
• 对话管理
• 多渠道集成

安装

git clone https://github.com/openclaw-skills/ai-intelligent-chatbot-builder
cd ai-intelligent-chatbot-builder
pip install -r requirements.txt
python app.py

---

创建：2026-03-13 作者：OpenClaw Skills Team