by 安全扫描
OpenClaw
可疑
high confidence该技能基本符合其LangChain描述，但嵌入了硬编码的API密钥，且会在未声明或不需要凭据的情况下将对话数据发送到外部API——这种不匹配是一个重要的安全和隐私问题。
评估建议
此技能表现为一个LangChain聊天助手，但在langchain_skill.py中包含硬编码的API密钥和端点，用于调用外部LLM服务。安装或运行前请注意：(1)不要使用敏感数据运行——您的消息和内存将被发送到第三方API；(2)将嵌入的密钥视为秘密泄露——应移除并替换为配置驱动的方法（使用环境变量），或获取您自己的密钥；(3)验证密钥所有者并考虑轮换任何已暴露的密钥；(4)如信任作者并想使用，请编辑代码从环境变量读取凭据（并更新技能元数据以声明），或完全移除硬编码密钥；(5)只安装来自受信任来源的包，并审查技能调用的网络端点。声明的元数据（无凭据）与嵌入的凭据之间的不匹配是此技能可疑的主要原因。...详细分析 ▾
⚠ 用途与能力
The code implements a LangChain-based chat with memory and a routing decision between 'DeepSeek' and 'Gemini', which aligns with the description. However, the skill includes an embedded API key and a DeepSeek API base URL inside the code despite the registry metadata declaring no required env vars or credentials—this credential presence is disproportionate to the metadata and should have been expressed as a required credential or configurable environment variable.
⚠ 指令范围
SKILL.md instructs using LangChain and mentions editing api_base/api_key in langchain_skill.py but does not warn that the distributed code already contains a hard-coded secret. The runtime instructions and code will transmit queries (and chat history via memory) to external services (DeepSeek and Google Gen AI). That network behavior and embedded credential are not surfaced as required credentials in the skill metadata.
ℹ 安装机制
There is no install spec (instruction-only model with a Python file), which minimizes install-time risk. However the skill depends on third-party Python packages (langchain and provider-specific packages) as noted in SKILL.md; those must be installed in the agent environment before run and will cause network/API calls at runtime.
⚠ 凭证需求
The skill declares no required environment variables but the code contains a hard-coded API key (openai_api_key="sk-e7ec5...39506694") and a fixed api_base (https://api.deepseek.com/v1). This is inconsistent: credentials are embedded rather than requested via config/env, and the skill will send user queries and memory to third-party endpoints using that embedded key. That raises privacy, consent, and credential-management concerns.
✓ 持久化与权限
The skill is not always-enabled and has no install-time persistence spec. It does not request system-level privileges or modify other skill configurations. Autonomous invocation is allowed (platform default) but is not combined with elevated installation privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/16
LangChain-skill-vmisep-2026 v1.0.0 — 带有对话内存（ConversationBufferMemory）的LangChain Python技能初始版本。支持越南语查询和简洁准确的回答。可定制的提示模板以匹配机器人角色。使用DeepSeek-chat作为默认LLM后端（可切换到Gemini）。包含使用说明和实用示例。成本优化：自动路由器、内存摘要、提示缓存和输出字数限制。
● 可疑
安装命令 点击复制
官方npx clawhub@latest install langchain-skill-vmisep-2026
镜像加速npx clawhub@latest install langchain-skill-vmisep-2026 --registry https://cn.clawhub-mirror.com
技能文档
Giới thiệu
Langchain Skill Vmisep 2026 là một skill sử dụng LangChain với memory và chain, hỗ trợ trả lời tiếng Việt, nhớ lịch sử chat và mở rộng RAG, tool calling, agent tự động.
Tính năng
- Conversation Memory: Sử dụng ConversationBufferMemory để lưu trữ lịch sử hội thoại
- Vietnamese Support: Hỗ trợ trả lời bằng tiếng Việt
- Customizable Prompts: Tùy chỉnh prompt template để phù hợp với persona của bot
- LLM Backend: Sử dụng DeepSeek-chat làm LLM mặc định (có thể chuyển sang Gemini)
- Cost Optimization:
Cách sử dụng
from langchain_skill import LangChainSkill# Khởi tạo skill
skill = LangChainSkill()
# Sử dụng
response = skill.run("Xin chào, bạn có thể giúp gì?")
print(response)
Cấu hình
Skill sử dụng các biến môi trường sau:
DEEPSEEK_API_KEY: API key cho DeepSeekGEMINI_API_KEY: API key cho Gemini (tùy chọn)
Ví dụ
Xem thêm các ví dụ trong thư mục examples/
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制