37/100 (High)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： suspicious

OpenClaw： suspicious

The skill appears to implement Douyin upload/publish functionality, but its instructions and code read and persist sensitive credentials (.env) while the registry metadata does not declare any require...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： suspicious

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774339211596,
        "_id": "k979hrt7vr9gftk4ky9rfsbz0n83h6jk",
        "changelog": "自动登录抖音账号，上传并发布视频到抖音创作者平台，支持视频标签管理和登录状态检查。",
        "changelogSource": "user",
        "createdAt": 1774339211596,
        "version": "1.0.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "s17bdbdjf4sjr33p4v7wk1n2f583gv40",
        "displayName": "15027302155",
        "handle": "15027302155",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/26167913?v=4",
        "kind": "user",
        "linkedUserId": "kn72g70man6gbmnpxpxkeecb5983hhx0"
    },
    "ownerHandle": "15027302155",
    "skill": {
        "_creationTime": 1774339211596,
        "_id": "kd727704yg9zfjtwvef1ch700d83g3rj",
        "badges": [],
        "createdAt": 1774339211596,
        "displayName": "douyin push video",
        "latestVersionId": "k979hrt7vr9gftk4ky9rfsbz0n83h6jk",
        "ownerPublisherId": "s17bdbdjf4sjr33p4v7wk1n2f583gv40",
        "ownerUserId": "kn72g70man6gbmnpxpxkeecb5983hhx0",
        "slug": "douyin-push-video",
        "stats": {
            "comments": 0,
            "downloads": 14,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 1,
            "versions": 1
        },
        "summary": "协助用户将本地或用户提供的视频发布到抖音账号。包含上传流程说明、开放平台 API 使用指引及发布前检查。Use when: 用户要发抖音、上传视频到抖音、把视频发到抖音、post to Douyin、抖音发布。NOT for: 抖音视频下载、抖音数据分析、非发布类抖音操作。",
        "tags": {
            "latest": "k979hrt7vr9gftk4ky9rfsbz0n83h6jk"
        },
        "updatedAt": 1774340514094
    }
}