xiaoyue-companion

No direct malware or malicious executable logic is visible in this Markdown fragment. It documents a skill marketplace and automatically aggregates a very large number of third-party repositories, then instructs users to install dependencies and skills. This creates meaningful supply-chain risk because provenance, pinning, signatures, and vetting are not demonstrated. Review the repository's actual synchronization scripts, requirements.txt, main.py, ClawHub CLI, and each skill before execution or installation.

SUSPICIOUS. The core social-network capabilities match the stated purpose and API traffic stays on the official Moltbook domain, so this is not confirmed credential theft. However, the skill has medium supply-chain risk from mutable remote-hosted instructions, reads raw local credential files, and most importantly enables autonomous public posting/community interaction, which is high-risk and disproportionate for an always-available agent skill.

SUSPICIOUS. The main issue is internal inconsistency: the skill claims COZE-only, no local dependencies, yet its own examples require local package installs and script execution. The install source itself is ordinary PyPI documentation, so this is not confirmed malware, but the stated purpose, capabilities, and execution path do not align cleanly.

SUSPICIOUS: the skill's browser-control purpose is coherent, and most dependencies are legitimate, but it mandates running opaque local installer scripts and a curl|sh Rust bootstrap before use. It also copies existing Chrome login state into an automation profile and grants a powerful external browser CLI control over authenticated sessions, making the overall footprint high-risk though not confirmed malicious.

No clear evidence of intentional malware (no eval/child_process/backdoor/reverse shell) within this snippet. However, there are concrete high-risk security weaknesses: (1) SSRF in /api/tts/audio because it proxies an arbitrary URL from the client, and (2) filesystem path traversal/unsafe path construction in /api/voice/clone (user-controlled filename in fs.renameSync) and loadAgentSoul (user-influenced agentId used to read SOUL.md). These could enable unauthorized internal network access and unauthorized file read/overwrite depending on runtime permissions. OpenClaw integration in this file appears to be non-executing (returns guidance only), reducing likelihood of direct sabotage here.

No overt malicious payloads (e.g., backdoors, C2, credential-stealing scripts) are directly evident in this client-side fragment. However, the code contains multiple high-severity DOM XSS/attribute-injection patterns by using innerHTML with backend-controlled data (/api/multimodal/status, /api/starclaw/agents) and by rendering chat content via innerHTML in addMessage(). Because sensitive credentials/tokens (including an app secret) are stored in localStorage, successful XSS would likely enable theft and misuse of those secrets and potentially full compromise of the web app’s user session context. This module should be treated as a significant security risk requiring sanitization/escaping, removal of inline onclick string construction, and safer secret handling.

The fragment shows a significant DOM XSS vulnerability because it renders untrusted user input and untrusted server replies using innerHTML without escaping/sanitization. This is compounded by client-side handling of a sensitive API key stored in localStorage and sent with /api/chat requests; any XSS would likely enable theft and misuse of that key. No clear indicators of overt malware/backdoor behavior are present in the provided code, but the security risk from injection is high and warrants immediate remediation (use textContent/DOM APIs with escaping, sanitize HTML, and move secrets server-side).

The most significant risk is supply-chain adjacent but primarily in this module’s runtime behavior: when enabled, the server executes a local CLI/agent via child_process.exec using a command string that incorporates user-controlled message text. Escaping only double quotes is insufficient to prevent shell command injection. If an attacker can reach /api/chat (and OPENCLAW_ENABLED is enabled), they may be able to trigger unintended command execution on the host. Aside from this, the rest of the code largely performs API proxying and preset image selection, with some privacy/logging exposure due to logging user inputs.

SUSPICIOUS：主技能表面用途与能力大体一致，但其核心价值在于编排多个外部子技能，并执行多平台发布等现实动作。主要风险来自转移信任链、未完整审查的子技能、以及自动对外发布能力；未见足够证据认定为恶意或直接窃密。

No explicit malicious functionality is evident in this module: it primarily performs audio generation (remote API + polling + download) or local WAV synthesis, and it does not include backdoors, command execution, or obvious data theft. However, it presents moderate operational security risk due to (1) unsafe filename construction from untrusted title/name values (potential path traversal/overwrite), and (2) unvalidated downloading from audio_url returned by a remote API (potential SSRF-like behavior if the upstream response can be influenced). Additional review is recommended for the unseen retry/logger components and to harden filename sanitization, URL allowlisting, and logging practices.

SUSPICIOUS. 该技能的内容生成、图片搜索、官方微信草稿箱发布与用途基本一致，但其“推荐”微信发布路径把完整文章发送到不可验证的第三方裸IP明文HTTP接口，数据流与官方API不一致。小红书和B站又要求完整浏览器Cookie并绕过官方开放平台授权，权限范围和凭证处理都偏重。整体不是确认恶意代码，但对凭证与内容路由的设计明显超出稳妥边界。

No direct signs of intentional malware (no exec/eval, no persistence, no system command execution, no covert data theft) are present in the provided module. However, the module materially increases security/privacy exposure: it can download arbitrary remote URLs for covers (user-controlled egress), forwards user-provided article content/metadata to a configurable external HTTP endpoint (default non-TLS), embeds an access token in URL query strings, and prints full JSON responses to stdout. Additionally, the non-standard `coze_workload_identity.requests` import is a supply-chain auditing hotspot. Treat this as a medium-to-high integration risk rather than overtly malicious code.

SUSPICIOUS. The core PM capabilities are coherent and proportionate, with no direct credential theft or exfiltration signals, but the skill expands scope by instructing use of other skills and the provided install evidence depends on third-party marketplace/NPX paths that are not clearly first-party. Main risk is transitive trust and installer provenance, not confirmed malware.

No clear supply-chain malware/backdoor behavior is evident in this snippet. The dominant security concern is DOM-based XSS: user-controlled chat input is rendered via innerHTML without sanitization, allowing an attacker to inject arbitrary HTML/JS into the page context. Remote image loading adds a minor privacy/tracking risk, but XSS is the primary impact.

No clear indicators of intentional malware (exfiltration, backdoors, persistence, or covert system control) are visible in this module. The main concerns are supply-chain/security hazards: it performs PyTorch deserialization via torch.load on a user-supplied checkpoint path (--voice1) and runs ffmpeg as an external process on user-provided media inputs. Additionally, it modifies sys.path at runtime, which could enable import hijacking in a compromised deployment environment. Recommended mitigations: restrict voice1/weight files to trusted sources, avoid running with attacker-controlled artifacts, consider validating/checking checkpoint files, and run in a sandboxed environment where external media parsing (ffmpeg) and imports are controlled.

SUSPICIOUS. The publishing purpose broadly matches the functionality, but the skill’s core data flow is not direct-to-official APIs: it funnels content through an unverifiable self-hosted IP over HTTP and instructs users to centralize many platform credentials/cookies on that intermediary server. That scope and routing are disproportionate for a publishing helper and create significant interception, credential-forwarding, and unauthorized-posting risk.

No clear evidence of intentional malware is present in this fragment. However, it has high security risk due to (1) plaintext API key storage in localStorage and inclusion of that key in request bodies sent from the browser, (2) logging of the full requestBody (including the API key) to the console, and (3) critical DOM XSS potential from rendering untrusted user/server text using innerHTML without escaping. If the backend can return attacker-controlled content or if user input is echoed unsafely, an attacker could execute script in the page and potentially steal the stored API key and perform actions on behalf of the user.

SUSPICIOUS. The skill’s core video-processing behavior is mostly aligned with its purpose, and its Coze integration uses the official service endpoint. However, it embeds a hardcoded Coze API key and forwards optional Suno credentials to a third-party gateway (api.edata.cloud) instead of an official Suno API, creating significant credential-handling and data-flow concerns.

该技能总体目的与大部分本地视频处理能力相符，但存在两处关键不一致：一是硬编码 Coze API Key，二是把所谓 Suno API 凭证发送到非 Suno 官方的第三方域 `edata.cloud`。再叠加默认对外开放的文件服务器，整体应判为 SUSPICIOUS，而非 benign。

No clear evidence of deliberate malware/backdoor behavior in this module. However, it is security-sensitive: it downloads arbitrary attacker-controlled HTTP(S) URLs (including redirects) and writes the responses to disk, creating an SSRF/uncontrolled egress risk. Separately, its Markdown-to-HTML conversion performs insufficient escaping and inserts unvalidated link href values directly into HTML, creating a high XSS/HTML-injection risk if the resulting HTML is rendered or served without robust sanitization at a higher layer.

该技能与其声明用途基本一致：抓取、格式化并发布内容到官方平台，没有明显的凭据窃取或第三方中转迹象，因此不像恶意技能。但它具备高影响真实世界发布能力，依赖已登录浏览器会话，且文档中的依赖安装/执行链未固定版本并包含反自动化规避，整体应判为 SUSPICIOUS（高风险自动化工作流），不是确认恶意。

No direct evidence of classic supply-chain malware (no hardcoded credentials, no external exfiltration endpoints, no persistence/backdoor logic visible). However, the module is high-privilege automation code with multiple strong execution primitives: arbitrary JavaScript execution via CDP Runtime.evaluate() and additional injection risk from unescaped selector interpolation in clickElement(). It can also paste clipboard contents into pages and can spawn a local executable based on an environment override. Treat as security-sensitive: ensure only trusted callers can invoke it and strictly validate/sanitize url/selector/expression and the chrome executable path.

结论为 SUSPICIOUS。整体能力大体符合视频创作目的，但外部音乐生成功能将环境变量/技能凭证转发到第三方网关 api.edata.cloud，而不是明确官方 Suno 端点；这使数据流与声明不一致，风险高于普通创作技能。其余本地视频处理脚本基本正常。

SUSPICIOUS: The overall workflow mostly matches the stated purpose, and endpoints point to official Coze domains. Risk comes from forwarding a sensitive Coze API key through the less-verifiable coze-workload-identity package, plus implementation/documentation mismatches around the claimed automated knowledge base and publishing pipeline.

This module is a client for sending prompts and optional base64-encoded local images to an external chat API and returning/parsing descriptions. The main supply-chain/security red flag is the presence of hardcoded fallback credentials (including an API key) in main(), which can enable unauthorized use and accidental exposure of the maintainer’s credentials. Beyond that, it intentionally exfiltrates local image contents and user prompts to a third-party endpoint and may leak server error/response details via exceptions and console output. No clear malware primitives are present in the provided fragment, but the credential anomaly and data-sharing behavior warrant careful review and secret rotation.

This module is best characterized as an API client that transmits user prompts and optional local image content to a remote Coze endpoint, and can save model responses to disk. There is no clear evidence of classic malware capabilities (no exec/subprocess/backdoor/persistence, no additional suspicious network destinations). However, the presence of hardcoded fallback API credentials is a serious supply-chain/secrets red flag, and the error/printing/output handling may leak remote response content into logs or saved JSON. Treat the credential handling as the key security issue requiring immediate remediation (remove hardcoded secrets, enforce configuration, and minimize stored/printed response details).

No classic malicious payloads (e.g., eval/obfuscated code/reverse shells) are evident in this fragment, but the module exhibits strong supply-chain security risk characteristics. It hardcodes a Bearer token for a local automation/execution gateway, enables that capability by default, and forwards user-controlled task instructions based on broad keyword triggers. It also returns tool execution results to clients and lacks authentication/authorization, making it a practical abuse pathway for unauthorized local automation and sensitive data/operation leakage if deployed beyond a tightly controlled environment.

This code is a WeChat posting automation utility with significant security exposure due to (1) host-side command execution via execSync/spawnSync of an external browser automation tool and (2) repeated in-browser JavaScript execution via eval, where title/content and image paths are user-influenced. The fallback upload mechanism can read local files via file:// fetch in the browser context, then upload them through the UI. No clear backdoor or direct third-party exfiltration endpoints are evident in this file alone, but the overall design warrants strong supply-chain/input trust controls and careful review of the agent-browser binary’s command parsing and permissions.

SUSPICIOUS: the overall purpose is coherent for ecommerce automation, but the footprint is broader than a normal helper skill because it combines authenticated scraping, automated order placement using recipient PII, and weak publisher/release provenance. No direct evidence of credential theft or hidden exfiltration is shown, so this is not confirmed malware, but it carries meaningful operational and supply-chain risk.

This module is consistent with a legitimate local media-generation workflow (Markdown -> narration -> TTS audio -> subtitles -> ffmpeg rendering). It does not show clear malicious payload behavior such as exfiltration, backdoors, or credential theft. However, it materially increases operational attack surface by trusting unauthenticated localhost HTTP to supply binary MP3 data that is then processed by ffprobe/ffmpeg, and by dynamically constructing ffmpeg filter expressions that include locally generated paths and Markdown-derived subtitle text. If the local TTS service or surrounding environment can be tampered with, malformed audio or crafted inputs could pose a security risk via decoder/filter handling or ffmpeg parsing fragility.

SUSPICIOUS: 技能目的与核心能力基本一致，但存在两处关键不一致：一是代码实际依赖未声明的 coze_workload_identity，二是默认 ASR 端点与已知官方 Qwen ASR 文档不匹配。它会读取环境变量中的 API key、读取本地音频并上传到远程服务，且允许任意覆盖 base_url，导致凭证和音频可被重定向到非官方主机。未见明显恶意载荷、下载执行或隐蔽窃密逻辑，因此更像高风险/可疑集成而非确认恶意。

This module is not clearly malicious, but it has meaningful security risks suitable for hardening. The primary concern is that attacker-influenced Markdown image URLs are fetched over arbitrary http/https (including redirects) and streamed to local disk, enabling SSRF-like outbound access and resource exhaustion. A secondary concern is execution of an external renderer via 'npx -y bun', which increases toolchain/supply-chain and environment-resolution trust requirements. Local relative image path resolution lacks an explicit containment check to baseDir, which could become a file access issue depending on how the renderer consumes the returned localPath.

SUSPICIOUS。核心功能与“视频抽帧+视觉分析”基本一致，依赖也来自正常 PyPI 路径，无明显恶意下载执行。但技能包含硬编码 Coze API Key，并引导用户将图片内容发送到发布者提供的 Coze Bot/凭据；同时允许自定义任意 VISION_API_BASE，将图片与密钥转发到非官方端点。不存在明确恶意载荷或隐蔽窃密代码，但凭据处理和数据流完整性明显不当，风险中高。

No evidence of classic stealth malware (obfuscation, exfiltration to unknown domains, reverse shells, or packed payloads) is present in the provided fragment. However, the design and code show a high-impact control-plane: untrusted chat text is keyword-gated and forwarded—along with a privileged Authorization token—into an OpenClaw automation/execution API, enabling host/desktop actions. If the assistant endpoints are insufficiently authenticated/authorized or exposed via ngrok/frp or chat-bot channels without strong safeguards, this pattern can be exploited as a remote-command/backdoor-like interface. Security review should focus on enforcing strict authentication, per-user authorization, command allowlisting/schemas, rate limiting, and minimizing exposure of the execution endpoints.

This module is a dual-use cross-platform keystroke injection utility that performs a real paste (Cmd+V/Ctrl+V equivalents) to the active/frontmost application and explicitly aims to bypass synthetic paste-event detection. No network exfiltration or persistence is present in the provided code, but the behavior is inherently security-sensitive (UI input automation) and can be abused for clipboard-driven attacks. The highest concrete technical risk is on macOS: user-supplied --app is interpolated into dynamically constructed AppleScript executed via osascript without escaping/validation, creating an AppleScript-evaluation injection risk. Overall: elevated security risk; treat as high-impact automation code and restrict/validate inputs when used.

No clear evidence of embedded malware (no subprocess execution, no network exfiltration, no obvious backdoor logic) is present in this module. However, the code contains high-impact security weaknesses: (1) multiple user-controlled inputs are used directly to form filesystem paths for reads/writes and file serving without sanitization, creating a credible path traversal/unauthorized file access or overwrite risk; and (2) sys.path is modified to prioritize a local directory before importing the model code, increasing import/supply-chain integrity risk. Additionally, the service lacks visible authentication/rate limiting and returns raw exception messages, enabling abuse and information leakage. These issues warrant remediation before deployment, even if the module is not inherently malicious.

No clear evidence of embedded malware/backdoor behavior is present in the provided fragment; the logic shown is consistent with a standard HTTPS LLM chat-completions client. The main security issue is the presence of an inline literal API key/token in the example, which represents a serious credential-leak risk (account abuse/billing). Additionally, because the actual referenced PowerShell script(s) and skill implementation are not included here, extra unexpected network/file behaviors cannot be fully excluded. Rotate the exposed key and ensure secrets are never committed or redistributed; then review the referenced scripts for any additional egress, logging, or hidden behavior.

No clear supply-chain malware behavior is present (no obfuscation, no explicit exfiltration, no backdoor execution). The primary security concern is legitimate-but-risky operational behavior: it clones authenticated Chrome session state into a persistent automation profile and starts Chrome with remote debugging enabled on a fixed port (9222). If that debug interface is reachable by untrusted parties or if the automation profile directory is exposed, the script can enable session hijacking or browser control. Review and harden usage (e.g., restrict network access to localhost, reduce persistence of sensitive session data, and ensure strict filesystem permissions).

SUSPICIOUS: the core behavior mostly matches the stated legal-document conversion purpose, but PDF/DOCX support relies on transitive installation of another skill and may route sensitive documents to a cloud OCR service. Provenance is same-publisher and official MinerU endpoints are referenced, so this is not clearly malicious; the main concerns are transitive trust and external document transfer.

No direct evidence of malware is observable in the provided fragment because it contains mostly documentation and configuration examples, not the executable TypeScript/library code. However, the fragment contains a plaintext API key embedded in an OpenClaw configuration snippet, which creates a high likelihood of credential compromise and unauthorized API usage. Additional verification is required from the actual src/*.ts files and package.json (including scripts and dependencies) to rule out malicious behaviors beyond this configuration issue.

No direct evidence of malware/backdoors is present in the provided artifact because it is documentation rather than the package’s executable source. The key supply-chain security concern is a plaintext-looking API key embedded in the setup instructions, which represents a credential-leakage/billing-abuse risk if that key is real. The guide also describes multiple authenticated calls to an external image-generation API during automated generation, which is expected functionality but can increase operational impact if triggered unintentionally. Review the actual npm package source and CI/postinstall/test scripts for confirmation of network/file behaviors and for any secret handling issues.

No explicit backdoor, reverse shell, or direct external exfiltration is evident in this module. However, it presents significant security risk due to (1) supply-chain/code-execution enabling patterns—sys.path manipulation and ASR model loading with trust_remote_code=True—and (2) a concrete file-access weakness in GET /audio/<filename> where client-controlled filenames are used to construct filesystem paths without containment checks. These issues warrant hardening (path validation/normalization, least-privilege, removing trust_remote_code where possible, and eliminating sys.path insertion or pinning imports) before production use.

No direct indicators of stealthy malware behavior (e.g., credential theft, exfiltration, persistence, or reverse shells) are evident in this fragment. However, the script significantly increases supply-chain execution risk by (1) cloning an unpinned remote repository, (2) running pnpm install and npm run build:native which can execute lifecycle/build scripts from untrusted remote content, and (3) downloading and executing rustup-init.exe without visible checksum/signature verification. This is likely a legitimate installer, but it should be treated as a high-trust bootstrapper and reviewed/hardened (pin repo revision, enforce lockfiles, verify downloads, consider restricting lifecycle scripts).

No direct indicators of embedded malware (no downloads, no credential-stealing/exfiltration code, no obfuscated payloads, no persistence beyond normal profile storage). However, the script materially increases privacy/account takeover risk by (1) copying/importing existing Chrome profile state (including likely authentication/session-relevant data) into a persistent automation directory and (2) enabling Chrome DevTools remote debugging on a fixed port (9222), creating a potentially dangerous control surface if reachable beyond the intended trust boundary. Treat as a high-impact automation/session-security risk requiring strict access controls to both the debug port and the profile directory.

No overt malicious payload (e.g., credential theft, explicit exfiltration, reverse shells) is present in this shell wrapper itself; however, it is a high-risk supply-chain execution orchestrator. It clones an unpinned upstream repository, runs pnpm install and a native build (which commonly execute arbitrary lifecycle/build scripts from the fetched code and dependency tree), installs Chromium via npx downloads, and—most critically—executes a network-delivered installer script via curl | sh for rustup without additional verification. If upstream code or any downloaded dependencies are compromised, this script provides an end-to-end path from untrusted network content to executable artifacts on the host.

No direct malware behavior can be confirmed from this fragment because it is documentation/config guidance rather than the actual skill source code. However, the provided OpenClaw configuration example includes a plaintext API key, creating a serious credential exposure risk and enabling unauthorized or fraudulent use if the key is valid. Integration instructions also encourage loading built artifacts into the host runtime via copy/symlink, and npm install/build/test execute lifecycle code, but those risks depend on unseen package.json/dist contents. Treat the embedded key as compromised (rotate/revoke) and move secrets to a secure, non-committed mechanism (e.g., local .env/secret manager) before using the skill.

This fragment functions as a local orchestrator but contains a notable supply-chain/security red flag: it executes a locally stored PowerShell script using "-ExecutionPolicy Bypass" and then runs a Node.js entrypoint from a fixed directory, with no integrity/signature checks or validation shown. Whether the package is actually malicious cannot be determined from this fragment alone, but the execution method warrants inspection of openclaw.ps1 and server-with-openclaw.js (and their dependencies) for any credential access, filesystem tampering, or network exfiltration.

This PowerShell fragment itself does not show explicit malicious behavior (no obfuscated payloads, no network calls, no credential theft, no file/registry tampering beyond creating a scheduled task). However, it creates persistence via Windows Task Scheduler and will execute a local Python script at a predictable time, only gated by network availability. The primary security uncertainty—and potential supply-chain risk—lies in the contents/integrity of C:\D\StepFun\skill_store_updater\main.py and the trustworthiness of the Python interpreter resolved by the host.

This batch snippet is best characterized as a two-stage launcher combining (1) execution of a hardcoded local PowerShell script with -ExecutionPolicy Bypass from a non-standard user runtime directory, and (2) conditional npm install followed by execution of a Node entrypoint (server-with-openclaw.js) that likely depends on the effects of the first stage. Even though the actual malicious behaviors are not visible in this fragment (openclaw.ps1 and server-with-openclaw.js are not provided), the presence of PowerShell policy evasion, staged execution, and unverified install-time dependency execution represent a high-risk supply-chain/orchestration pattern. Treat the package/artifacts as suspicious until openclaw.ps1 and server-with-openclaw.js are inspected for network activity, persistence, credential theft, and system modification.

This fragment is a high-risk launcher pattern: it bypasses PowerShell execution policy and directly executes a local PowerShell script from a user-specific, non-standard staging directory, passing a mode-like argument ("gateway"). While the snippet contains no explicit networking or credential handling itself, the execution method is strongly consistent with a dropped/bundled payload loader; the true maliciousness cannot be proven without inspecting openclaw.ps1. Treat this as potentially malicious until the referenced script is reviewed and verified.

This module’s intent is benign (run a formatting/autocorrection tool), but it constructs and executes a shell command using execSync with direct interpolation of a caller-controlled filePath, creating a command-injection risk if filePath is attacker-influenced. It also relies on npx to execute an external tool/package at runtime, which increases execution/supply-chain exposure in the broader environment. No direct malicious payload behavior (e.g., network exfiltration, credential theft, persistence, obfuscation) is evident in this snippet alone.