by 安全扫描
OpenClaw
可疑
medium confidenceThe skill generally matches its stated purpose (proposal generation) but contains undeclared billing integration with a hard-coded API key and other implementation inconsistencies that could leak user identifiers or enable unexpected charges.
评估建议
This skill appears to do what it says (generate proposal text and pricing), but exercise caution before installing: 1) index.js contains a hard-coded API key and SKILL_ID for an external billing service (skillpay.me). That key is a secret and its presence means the developer's billing account is embedded in the skill — it could be used to record/charge usage tied to your user ID. 2) The SKILL.md and metadata do not declare any required credentials or mention that user identifiers will be sent ex...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose (generate freelance proposals, scoring, pricing, follow-ups) matches the code's functionality. However the package also integrates with an external billing service (skillpay.me) even though SKILL.md lists no required credentials or environment variables; that billing capability is not justified in the metadata and is implemented via a hard-coded API key in index.js.
⚠ 指令范围
SKILL.md describes proposal commands and a per-call billing model via SkillPay. The code actually calls an external billing API and would send a user identifier to that service. The SKILL.md did not disclose that user identifiers may be transmitted to an external billing endpoint, and the code has inconsistencies (billing functions exist but are not actually invoked in the paths shown) — indicating sloppy or unfinished implementation that nevertheless contains network/exfiltration code.
✓ 安装机制
No install spec is provided and this is effectively an instruction-only skill with a single JS file. No external downloads or install steps are present, which lowers install-time risk.
⚠ 凭证需求
The skill declares no required environment variables, yet index.js contains a hard-coded BILLING_API_KEY and SKILL_ID. Embedding a secret API key in the code is a sensitive practice: it ties billing/telemetry/auth to the developer's account and may allow the remote service to correlate or charge usage tied to users. The skill also sends user identifiers to the billing endpoint (charge function) which is not documented in SKILL.md's privacy notes.
✓ 持久化与权限
The skill does not request permanent 'always' presence, does not declare system config paths, and does not attempt to modify other skills or system-wide settings. No extra privileges are requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.02026/3/5
中文版 Upwork 提案助手，支持多种风格，智能评分，计费集成。添加中文命令别名，付费解锁完整功能。定价：每次调用 0.001 USDT，通过 SkillPay.me 计费，余额不足返回充值链接。
● 可疑
安装命令 点击复制
官方npx clawhub@latest install proposal-copilot
镜像加速npx clawhub@latest install proposal-copilot --registry https://cn.clawhub-mirror.com
技能文档
Read the user input and produce structured output for freelance bidding.
Commands
proposal 帮助: Show command usageproposal 生成: Generate full proposal package (score + proposal + pricing + followups)proposal 生成: Generate proposal in selected style (paid)proposal 生成 预览: Free preview (first lines)proposal 评分: Only return bid-worthiness score + reasonsproposal 报价: Return pricing suggestion (paid)proposal 跟进 <客户名> <岗位简述>: Return D+1/D+3/D+7 follow-up copies (paid)
Output Rules
Always return concise, copy-paste ready text.
For proposal 生成, return JSON with keys:
score(0-100)decision(BID|MAYBE|SKIP)summary(one-line 投标建议结论)reasons(array)proposal_enpricingmilestonesfollowups
Pricing Rules (MVP)
- If JD is clear + budget reasonable + skill match high: higher recommendation.
- If scope is vague: conservative pricing and add clarification questions.
- For hourly mode, return
recommended_rate,alt_rate_low,alt_rate_high. - For fixed mode, return 3 milestone split.
Score Rubric (100)
- Budget match: 30
- Requirement clarity: 20
- Skill fit: 25
- Client quality signals: 15
- Delivery feasibility: 10
Decision threshold:
>=70: BID50-69: MAYBE<50: SKIP
Billing
This skill must charge 0.001 USDT per paid generation call via SkillPay billing API.
If insufficient balance, return payment link.
Notes
MVP focuses on speed and practical output. Do not over-explain.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制