Ai Intelligent Live Chat

在线客服，实时聊天 + AI 问答。

Security Scan

The SKILL.md asks you to git-clone and run a remote GitHub project (which could execute arbitrary code) while the skill bundle itself contains no code and doesn't declare the GPT/API credentials it mentions — this mismatch is concerning.

Purpose & Capability

The skill claims 'GPT 集成' (GPT integration) and WebSocket live chat, but the package contains no code and declares no credentials. Asking to clone and run a remote repo to provide the claimed functionality is inconsistent with an instruction-only skill that should either include its code or declare required credentials and exact dependencies.

Instruction Scope

The runtime instructions tell the user/agent to run: git clone https://github.com/openclaw-skills/ai-intelligent-live-chat; pip install -r requirements.txt; python app.py. That directs the agent to download and execute third-party code (not included in the skill bundle). The instructions do not state what environment variables (e.g., OpenAI/API keys) are required, nor do they limit what the cloned code may do (file access, network calls, env reading).

Install Mechanism

Although the skill itself has no install spec, the SKILL.md recommends pulling arbitrary code from a GitHub repository and running pip install on its requirements — an extract-and-execute workflow from an external URL. This pattern has higher risk because it will write and execute remote code on the host and the bundle provides no verification or checksum for the repo.

Credentials

The skill mentions GPT integration but declares no required environment variables or primary credential. A legitimate GPT-integrated chat service would normally require at minimum an API key (OpenAI or another provider). The absence of declared credentials is a mismatch and may hide required secrets that the remote code will prompt for or read from the environment.

Persistence & Privilege

The skill does not request 'always' or other elevated persistent privileges and is user-invocable only. That is appropriate. However, because it instructs downloading and running external software, it can still create persisted services or network-exposed processes when executed — you should treat it like installing untrusted software.

What to consider before installing

Do not run the provided git/pip/python commands on any machine you care about without first inspecting the remote repository. The skill bundle contains no code but tells you to clone and execute code from GitHub — that can install malware or exfiltrate secrets. Before installing: (1) verify the exact GitHub repository URL and its owner; (2) review the repo contents (app.py, requirements.txt, setup scripts) for unexpected behavior (network calls, reading env vars, uploading files); (3) check whether the app requires an OpenAI/API key and ensure keys are handled securely (not committed to repo); (4) run installs and the app inside an isolated sandbox/container; (5) prefer a skill that includes its code in the bundle or provides a signed release and a clear list of required environment variables and permissions. If you want help auditing the remote repo, provide its URL or the repo content and I can scan it for risky patterns (exfiltration, secrets-reading, obfuscated code).

AI 智能在线客服系统

描述

在线客服，实时聊天 + AI 问答。

功能

• 实时聊天（WebSocket）
• AI 问答（GPT集成）
• 多客服接入（客服分配）
• 聊天记录（历史记录）
• 满意度评价（评价系统）

定价

• 基础版：¥199/月（3 客服）
• 专业版：¥999/月（30 客服）
• 企业版：¥2999/月（无限客服）

适用场景

• 在线客服
• 销售咨询
• 技术支持
• 售后服务

技术栈

• Python + FastAPI
• WebSocket
• GPT 集成
• 客服系统

安装

git clone https://github.com/openclaw-skills/ai-intelligent-live-chat
cd ai-intelligent-live-chat
pip install -r requirements.txt
python app.py

---

创建：2026-03-13 作者：OpenClaw Skills Team