by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is a simple Node-based wrapper for a third-party Doubao API and largely matches its chat purpose, but metadata and documentation disagree about required credentials and capabilities (e.g., a web-search claim and an unneeded curl requirement), so there are incoherences you should verify before installing.
评估建议
This skill appears to be a small Node script that sends prompts to a third‑party API and requires you to provide DOUBAO_SESSIONID (sent as a Bearer token). Before installing: (1) Confirm the DOUBAO_SESSIONID is safe to use here — it may grant access to your Doubao account; prefer a limited/throwaway token if possible. (2) Verify the API host (doubao-free-api.vercel.app) is legitimate and intended by the publisher — the skill's homepage is doubao.com but the API is hosted on Vercel, which may be ...详细分析 ▾
ℹ 用途与能力
Name/description claim a Doubao chat with web-search support; the code implements a basic chat client calling https://doubao-free-api.vercel.app/v1/chat/completions which is consistent with a chat skill, but the advertised 'supports联网搜索' (web search) is not implemented in the script. Also SKILL.md metadata lists required binaries ['curl','node'] while the included script only needs node.
ℹ 指令范围
SKILL.md instructs setting DOUBAO_SESSIONID and running node scripts/chat.js, which matches the script's behavior. The instructions do not read other files or exfiltrate local data. However the runtime instructions mention an API endpoint on a Vercel domain rather than the skill homepage (doubao.com), which is an unexpected divergence the user should confirm.
✓ 安装机制
Instruction-only skill with a small included Node script and no install spec — nothing is downloaded or written to disk by an installer. This is low install risk.
⚠ 凭证需求
The script requires a DOUBAO_SESSIONID environment variable (used as a Bearer token) but the registry metadata claimed no required env vars; this mismatch is a notable incoherence. No other credentials are requested, which is proportionate, but you should confirm where the session token is valid and whether it grants account-level access.
✓ 持久化与权限
The skill does not request always: true and does not persist or modify other skills or system config. It runs only when invoked.
安装前注意事项
- Confirm the DOUBAO_SESSIONID is safe to use here — it may grant access to your Doubao account; prefer a limited/throwaway token if possible. (
- Verify the API host (doubao-free-api.vercel.app) is legitimate and intended by the publisher — the skill's homepage is doubao.com but the API is hosted on Vercel, which may be a proxy. (
- Ask the publisher to correct registry metadata to declare the required env var and to remove the unnecessary 'curl' requirement, and to clarify whether web-search is actually supported. If you cannot verify these points, avoid supplying production or sensitive credentials to this skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/8
Initial release of doubao-chat skill. - Enables conversation with Doubao model using a free API. - Supports internet-connected search queries. - Requires session ID as an environment variable. - Simple usage with Node.js command. - Includes POST endpoint for chat completions.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install doubao-chat
镜像加速npx clawhub@latest install doubao-chat --registry https://cn.clawhub-mirror.com
技能文档
使用豆包免费 API 进行对话，支持联网搜索。
环境变量
DOUBAO_SESSIONID=your_sessionid
使用方法
node scripts/chat.js "你好"
API 端点
对话补全：POST https://doubao-free-api.vercel.app/v1/chat/completions
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制