ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Dialogflow Cx Agents

v1.0.0

Manage agents in Google Dialogflow CX via REST API. Use for creating, listing, updating, and deleting chatbot agents. Supports v3beta1 API.

⭐ 0· 308·0 current·0 all-time
byYash Kavaiya@yash-kavaiya
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name and description (Dialogflow CX agent management) align with the included scripts and SKILL.md. The Python CLI uses the google-cloud-dialogflow-cx client and exposes list/get/create/update/delete/export/validate operations — all expected for this purpose.
ℹ
Instruction Scope
SKILL.md contains concrete curl examples and a CLI usage for the included script. It instructs using gcloud auth or a service account and to provide PROJECT_ID, LOCATION, AGENT_ID, or full agent names. It does not attempt to read unrelated system files or send data to non-Google endpoints. Note: SKILL.md references the environment variable GOOGLE_APPLICATION_CREDENTIALS and a TOKEN variable (from gcloud) — these are normal but are not declared in the registry metadata.
✓
Install Mechanism
No install spec in registry; the script recommends installing standard PyPI packages (google-cloud-dialogflow-cx, google-auth) via pip. No downloads from unknown URLs or extraction of remote archives are present.
ℹ
Credentials
The skill requires Google Cloud credentials to operate (gcloud auth / bearer token or GOOGLE_APPLICATION_CREDENTIALS pointing to a service account JSON). Those credentials are appropriate and necessary for Dialogflow management, but the registry metadata lists no required env vars — SKILL.md uses environment variables that the metadata did not declare.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated platform privileges. It does not modify other skills or system-wide settings. Exporting agents writes to a local file (as expected) or references a GCS URI, which is within scope.
Assessment
This skill appears to do only Dialogflow CX agent management. Before installing: (1) Be prepared to authenticate with gcloud or provide a service-account JSON (GOOGLE_APPLICATION_CREDENTIALS) — treat that JSON like sensitive credentials and use least-privilege roles. (2) Install the listed Python packages in an isolated environment (venv) so third-party libs don't affect system packages. (3) Review the included scripts locally if you want to verify behavior; exports write agent content to disk. (4) Note the registry metadata did not list the env vars referenced in SKILL.md (TOKEN and GOOGLE_APPLICATION_CREDENTIALS), so ensure you supply credentials only when you trust the runtime.

Like a lobster shell, security has layers — review code before you run it.

latestvk97906tzcs4pmn872kk9663721821wz2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments