技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v8.0.6
统计：⭐ 0 · 257 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：1227323804/sensitive-check-skill
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill claims to be a FastAPI REST service but the included code acts as an OpenClaw wrapper that fetches web pages with Selenium and POSTs content (and a caller-supplied userKey) to an external UCAP pre-production endpoint while disabling SSL verification — the pieces are inconsistent and could expose data.
目的
The package description says it is a FastAPI-based REST service, but the code provides an OpenClaw run(params) entrypoint that proxies content to an external URL (https://safeguard-pre.ucap.com.cn/...). There is no FastAPI app, no server startup, and the SKILL.md instructs installing a remote skill rather than running a local FastAPI. The presence of Selenium-based URL fetching and a dependency on Chrome/ChromeDriver is not mentioned in the de…
说明范围
SKILL.md is minimal (two lines) and tells callers to install a remote skill and pass userKey and content. The actual runtime code will: (a) if content is a URL, render the page with Selenium (headless Chrome) and capture the page_source; (b) always POST the content to an external UCAP pre-production API with the userKey placed in an HTTP header. The code also disables SSL verification (verify=False) and suppresses InsecureRequestWarning. That …
安装机制
There is no install spec even though requirements.txt lists requests, urllib3, and selenium. The code depends on a Chrome browser and matching ChromeDriver (webdriver.Chrome) but required binaries are not declared. Because no install mechanism is specified, a user or agent may not realize it needs a browser and driver; attempts to run the skill may fail or attempt to install/run a headless browser in the agent environment unexpectedly.
证书
The manifest requests no environment variables, but runtime requires a caller-supplied userKey parameter (sensitive credential) which is sent as an HTTP header to the remote UCAP endpoint. The skill also disables SSL verification, increasing risk to confidentiality/integrity of transmitted data. Asking for a userKey parameter is not inherently wrong, but the skill neither declares it nor documents how the key is stored/transmitted securely — d…
持久
The skill does not request always:true, does not modify other skills, and does not appear to persist credentials or change agent-wide config. It runs as an invoked skill and has no elevated persistence privileges in the manifest.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「错敏信息检测」。简介：基于FastAPI的文本错敏信息检测服务，识别敏感词、错别字及规范表述问题，提供RESTful API接口调用。。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/1227323804/sensitive-check-skill/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
1. 安装https://clawhub.ai/xxxx/sensitive-check-skill 这个技能
2. 调用错敏信息检测技能，传入参数 userKey=xxxx，content=xxxx