by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill legitimately needs Alibaba Cloud OpenSearch credentials (endpoint, instance id, username/password, datasource) even though the registry metadata omits them — that inconsistency is the main red flag. Before installing: 1) Only provide credentials with the minimal permissions needed (prefer a read-only account for testing); 2) Run the skill in an isolated environment (venv, limited network) and review outputs written to output/alicloud-ai-search-opensearch/ because API responses may inc...详细分析 ▾
ℹ 用途与能力
The code and SKILL.md align with the stated purpose: they use the alibabacloud-ha3engine SDK to push documents and run HA/SQL searches on OpenSearch. However, the registry metadata lists no required environment variables or primary credential while the SKILL.md and script clearly require multiple OpenSearch credentials (endpoint, instance id, username/password, datasource, etc.). That mismatch is unexpected and should be corrected.
✓ 指令范围
The runtime instructions stay within the stated purpose: install the SDK, set OpenSearch env vars, push/search, and save outputs. They do not request unrelated system files or broad context gathering. Note: the examples print API responses and instruct saving evidence files (which may include IDs, responses, or sensitive content).
✓ 安装机制
There is no automated install spec (instruction-only). The SKILL.md recommends installing the official pip package alibabacloud-ha3engine in a venv, which is a reasonable approach and lower risk than arbitrary downloads.
⚠ 凭证需求
The env vars required by the SKILL.md (OPENSEARCH_ENDPOINT, OPENSEARCH_INSTANCE_ID, OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD, OPENSEARCH_DATASOURCE, optional PK_FIELD/CLUSTER) are proportionate to the skill's function. The concern is that the skill metadata did not declare any required env vars or primary credential — this inconsistency could confuse permission/secret handling and automation that relies on the registry metadata.
✓ 持久化与权限
always is false and the skill does not request persistent or system‑wide privileges. It does not attempt to modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install alicloud-ai-search-opensearch
镜像加速npx clawhub@latest install alicloud-ai-search-opensearch --registry https://cn.longxiaskill.com