by 安全扫描
OpenClaw
可疑
high confidenceThe skill does what it claims (send Telegram notifications for F5-TTS training) but contains hard-coded Telegram credentials and reads host .env and training logs, creating a realistic risk of unintended data exfiltration to the embedded bot owner unless you explicitly override them.
评估建议
Do not run these scripts without reviewing and editing them. Specific recommendations:
- Remove or replace the hard-coded TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID in docker_notify.sh and notify.sh before use; supply your own token/chat via environment variables or a local .env under your control.
- Assume failure notifications may include snippets of training logs and the command used; inspect docker_train.sh and train_with_notify.sh and remove or sanitize any log or command text you do not want ...详细分析 ▾
⚠ 用途与能力
Name/description match the code (notification around F5-TTS training). However the registry metadata declares no required env vars/credentials while the SKILL.md and scripts clearly require TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID — a mismatch. Also SKILL.md and scripts reference absolute developer paths (e.g. /home/seiya/...), which are environment-specific and surprising for a generic skill.
⚠ 指令范围
Runtime instructions and scripts will read .env files from multiple locations (including an absolute project path) and, on failure, collect and send the last ~50 lines of training logs ($LAST_LOG) in docker_train.sh and command/exit info in train_with_notify.sh. That means runtime behavior can transmit local log contents and command-line context to the Telegram account controlled by the token — which is broader than a simple 'notify success/failure' if those logs/commands contain sensitive data.
✓ 安装机制
No install spec and no downloads; this is an instruction + script bundle only, which reduces installation risk. The code runs local shell and Node.js but does not install external packages automatically.
⚠ 凭证需求
The skill legitimately needs TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID, but the registry metadata did not declare them (incoherent). More importantly, the scripts include hard-coded default values for these variables (e.g. TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID embedded in docker_notify.sh and notify.sh). If a user does not supply their own env vars, notifications (including potentially large log excerpts) will be sent to the embedded bot/chat controlled by whoever published the skill, which risks leaking local information.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills, and does not require elevated system privileges. It runs only when invoked via the provided scripts.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/6
Initial release of f5-telegram-notify. - Sends Telegram notifications when F5-TTS training completes or fails. - Supports notification for start, success, and error events. - Designed for use in Docker environments. - Requires TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID in a .env file. - Includes a command-line script for customizable message sending.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install f5-telegram-notify
镜像加速npx clawhub@latest install f5-telegram-notify --registry https://cn.clawhub-mirror.com
技能文档
สคริปต์สำหรับส่งการแจ้งเตือน Telegram เมื่อ F5-TTS training process เสร็จสิ้นหรือล้มเหลว
การใช้งาน
1. ส่งแจ้งเตือนสำเร็จ
node /home/seiya/projects/openclaw/workspace/skills/f5-telegram-notify/scripts/notify.mjs success "Training เสร็จแล้ว!" "model_name" "/path/to/checkpoint"
2. ส่งแจ้งเตือนล้มเหลว
node /home/seiya/projects/openclaw/workspace/skills/f5-telegram-notify/scripts/notify.mjs error "Training ล้มเหลว: CUDA out of memory" "model_name"
3. ส่งแจ้งเตือนเริ่ม training
node /home/seiya/projects/openclaw/workspace/skills/f5-telegram-notify/scripts/notify.mjs start "เริ่ม training แล้ว" "model_name"
พารามิเตอร์
- status:
success|error|start - message: ข้อความที่ต้องการส่ง
- model_name: ชื่อโมเดล (optional)
- checkpoint_path: Path ไปยัง checkpoint (optional, สำหรับ success)
Config Required
ต้องมีไฟล์ .env ที่มี:
TELEGRAM_BOT_TOKEN=your_bot_token
TELEGRAM_CHAT_ID=your_chat_id
โครงสร้างไฟล์
f5-telegram-notify/
├── SKILL.md
├── scripts/
│ └── notify.mjs
└── README.md
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制