41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill does what it claims (posts to a social API) but embeds a hardcoded API key and points to an undeclared third-party Replit endpoint — a mismatch that could let others post via that service an...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1772147420583,
        "_id": "k977mk9d5gtrt9m3bw9549k0d981x50n",
        "changelog": "Initial release",
        "changelogSource": "user",
        "createdAt": 1772147420583,
        "version": "1.0.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "JPaulGrayson",
        "handle": "jpaulgrayson",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/212611253?v=4",
        "kind": "user",
        "linkedUserId": "kn75h5qg11dr8c9tyeavswt67181rf1w"
    },
    "ownerHandle": "jpaulgrayson",
    "skill": {
        "_creationTime": 1772147420583,
        "_id": "kd78ptbq4fw749a9f77gnzdrb981w7g7",
        "badges": [],
        "createdAt": 1772147420583,
        "displayName": "Social Poster",
        "latestVersionId": "k977mk9d5gtrt9m3bw9549k0d981x50n",
        "ownerUserId": "kn75h5qg11dr8c9tyeavswt67181rf1w",
        "slug": "social-poster",
        "stats": {
            "comments": 0,
            "downloads": 719,
            "installsAllTime": 4,
            "installsCurrent": 4,
            "stars": 0,
            "versions": 1
        },
        "summary": "Post to social media via VibePost API. Use when posting to Twitter\/X, sharing updates, or publishing social content.",
        "tags": {
            "latest": "k977mk9d5gtrt9m3bw9549k0d981x50n"
        },
        "updatedAt": 1774327416617
    }
}