📦 cpbox-suggest — 智能补全
v1.0.0实时查询补全服务：用户输入时<100ms返回建议，支持实体信息增强与抗拼写错误，让搜索更快更准。
0· 116·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill is functionally coherent for autocomplete/suggestions and doesn't request credentials, but it directs you to an external payment flow that uses third‑party SDKs (the npx command) and an external facilitator domain. Before installing or running it: 1) verify the reputations of https://www.cpbox.io and https://www.cppay.finance and the @springmint package on npm; 2) do not run npx commands unless you trust and have reviewed the package (npx downloads and executes remote code); 3) keep a...详细分析 ▾
✓ 用途与能力
Name, description, endpoints, parameters, and response fields all align with a query-autocomplete/suggest service. No unrelated environment variables, binaries, or config paths are declared.
ℹ 指令范围
Most instructions stay within the suggest/HTTP API scope (GET to https://www.cpbox.io/api/x402/suggest). However the doc recommends using third‑party SDKs (e.g., npx @springmint/x402-payment or x402-sdk-go) to perform payment signing — this instructs the operator/agent to execute code fetched from npm or other tooling and to perform cryptographic signing steps, which widens scope beyond simple HTTP queries.
ℹ 安装机制
There is no formal install spec (instruction-only), which is low risk. But the Quick Start suggests using npx to run @springmint/x402-payment; npx dynamically downloads and executes code from the npm registry at runtime, which can be a vector for executing remote code if followed. The skill itself does not ship code, but its recommended workflow depends on remote packages.
ℹ 凭证需求
The skill declares no required env vars or credentials, which matches a public suggest API. However the x402 payment flow implies use of a local wallet/key to sign requests; those keys are not declared or explained by the skill. The SKILL.md states 'wallet/keys stay on your machine', but does not describe how signing is performed or what local access is needed, so users must ensure signing is done safely (e.g., with a dedicated wallet) and not exfiltrated.
✓ 持久化与权限
No always:true, no requested persistent system presence, and no instructions to modify other skills or system-wide settings. The skill is user-invocable and does not ask to enable itself permanently.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/20
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install cpbox-suggest
镜像加速npx clawhub@latest install cpbox-suggest --registry https://cn.longxiaskill.com