Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Display Name: ChatMerge - 智能多渠道聊天纪要助手

v1.0.0

一键读取 20+ 平台聊天,生成智能纪要(摘要、决策、行动项、风险、多维分析、AI 建议)。Auto-read 20+ platforms, generate smart minutes with summaries, decisions, actions, risks, multi-dimensional an...

0· 74·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to auto-read 20+ chat platforms and to create/track tasks in external services (Jira/Notion/GitHub). That purpose plausibly requires access to platform/channel tokens and integration credentials. However, the registry metadata lists no required environment variables or config paths, which is inconsistent with the documented integrations and with the QUICKSTART/ADVANCED_FEATURES instructions that show env-based credentials (e.g., JIRA_API_TOKEN, NOTION_API_KEY, GITHUB_TOKEN, ZOOM_API_KEY). This discrepancy is unexplained and unexpected.
!
Instruction Scope
The SKILL.md explicitly instructs the agent to: read configured channels via the 'message' tool, list channels the user can access, read local files (example: ~/.openclaw/openclaw.json), accept files from the user, schedule persistent jobs, enable real-time monitoring, and optionally post clarifying questions or create tasks in external systems. Those instructions give the agent broad discretion to read local config and channel data and to send messages or create external resources — all reasonable for the described feature set, but they also expand the surface for credential access and data transmission. Importantly, the SKILL.md references environment/config credentials that are not declared in the skill metadata.
Install Mechanism
Instruction-only skill with no install spec and no code files. That is lower-risk from an installation/execution standpoint (nothing is downloaded or executed at install time).
!
Credentials
Although the registry lists no required env vars, the docs and advanced config examples require multiple sensitive credentials (chat platform bot tokens, JIRA/NOTION/GITHUB tokens, calendar tokens, Zoom/meeting API keys). The skill's allowed-tools include 'read' and 'write', meaning it can read local config files where such tokens are commonly stored (e.g., ~/.openclaw/openclaw.json). The lack of declared required credentials in metadata is a proportionality and transparency problem: users may not be warned that sensitive tokens are needed or accessed.
Persistence & Privilege
always:false (good). The skill supports scheduled jobs and real-time monitoring, which implies persistent background behavior (the agent will be expected to maintain monitoring and scheduled tasks). This persistent behavior increases the blast radius if credentials are available, but persistence is implemented via OpenClaw configuration rather than an always:true skill flag. Users should be aware that enabling monitoring or scheduling gives the skill ongoing access to channels until stopped.
What to consider before installing
What to check before installing or enabling this skill: - Metadata mismatch: the registry claims no required env vars, but docs show the skill needs many tokens (chat platforms, Jira/Notion/GitHub, calendar, meeting APIs). Ask the publisher to declare exactly which credentials the skill will access and why. - Where tokens live: the QUICKSTART instructs editing ~/.openclaw/openclaw.json; the skill's allowed-tools include read/write, so the agent could read that file. Verify what is stored there and prefer putting minimal, scoped tokens (least privilege) or using per-integration limited scopes. - Integrations: if you enable automatic creation of Jira/Notion/GitHub items, provide tokens with narrowly scoped permissions (e.g., allow issue creation but not admin access), and avoid sharing broad admin tokens. - Persistent monitoring and scheduling: enabling those features grants ongoing access to channels. If you don't want continuous access, use one-shot modes (file import or manual paste) instead of enabling monitoring or scheduled tasks. - Posting capability: the skill may post messages or ask clarifying questions in channels. Confirm whether you want it to post autonomously and review its confirmation/approval behavior (auto-create vs. require explicit confirmation). - Audit and logs: ask how the skill records its actions (task creations, notifications). Despite claims of 'no storage', scheduling/monitoring and incremental updates typically require storing some state; confirm where state is stored and retention policies. If you are not comfortable granting channel/config access or providing integration tokens, prefer using manual file import or paste mode, and only enable integrations one at a time with least-privilege credentials. Finally, request the maintainer to update registry metadata to list required env vars and config paths so you can make an informed decision.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eyjqxts4qa0dt3bvaxrkpbh83gsyf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

💬📊 Clawdis

Comments