Ai Intelligent Live Chat

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: ai-intelligent-live-chat Version: 1.0.0 The skill bundle contains only metadata and documentation (SKILL.md, skill.json, _meta.json) for an AI-powered live chat system. It lacks any executable code, and the instructions provided are standard for software installation (git clone, pip install). No indicators of malicious intent, data exfiltration, or prompt injection were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the setup would execute code and dependencies that are not present in the reviewed artifact set.

Why it was flagged

The skill package contains no code or install spec, but the documented setup asks the user to fetch dependencies and run code from an external repository. This is disclosed and user-directed, so it is a supply-chain note rather than a concern.

Skill content
git clone https://github.com/openclaw-skills/ai-intelligent-live-chat
cd ai-intelligent-live-chat
pip install -r requirements.txt
python app.py
Recommendation

Inspect the external repository and requirements file before running the commands, and prefer pinned, trusted dependencies.

What this means

Customer conversations may contain private or business-sensitive information that needs clear retention and provider-handling rules.

Why it was flagged

The documented features imply that customer chat content may be stored as history and used with a GPT integration, but retention and data-handling boundaries are not described.

Skill content
- AI 问答(GPT集成)
- 聊天记录(历史记录)
Recommendation

Before deployment, define where chat logs are stored, who can access them, how long they are retained, and what data is sent to any GPT provider.

What this means

A user might over-trust the skill or its external repository based on the official-sounding attribution.

Why it was flagged

The SKILL.md attribution is official-sounding, while skill.json lists a different author and the registry source is unknown. This is a provenance ambiguity users should verify before trusting the external install instructions.

Skill content
作者:OpenClaw Skills Team
Recommendation

Verify the publisher, repository ownership, and release provenance before installing or deploying the referenced application.