by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Key things to consider before installing or enabling this skill:
- It will call external image/LLM APIs and therefore will send prompts and (potentially large) portions of your paper text to those endpoints. Only configure API keys for services you trust and understand the provider's privacy policy.
- The chart generator component accepts a model-produced Matplotlib script and writes it to disk then executes it with subprocess.run. That means arbitrary Python code produced by the LLM (or retur...详细分析 ▾
ℹ 用途与能力
Name/description (paper→diagram generation) align with the code and required binaries: Python and an external image-generation API (BANANA2 / acedata). The primary credential (BANANA2_API_KEY) is appropriate. One minor incoherence: many modules expect an LLM callable (llm_call_fn) and SKILL.md suggests PAPER_DIAGRAM_LLM_URL/KEY, but those LLM env vars are not declared as required — they are optional but used in prompts/fallbacks. Overall capabilities are consistent with the stated purpose.
⚠ 指令范围
Runtime instructions and code cause network calls to external image-generation APIs and may send substantial paper text and generated prompts. The chart_generator writes and executes arbitrary Python code (via subprocess.run) that originates from model-generated content — this is powerful and can run arbitrary code on the host. image_generator also disables session.trust_env (bypassing system proxy environment variables), which can change networking behavior and has privacy implications. SKILL.md recommends storing API/LLM keys in a config file (~/.openclaw/openclaw.json), which implies persistent local storage of secrets.
ℹ 安装机制
The skill is instruction-only in registry terms (no install spec) but includes multiple Python scripts that require dependencies (requests, pdfminer.six, optional PyMuPDF/pypdf/pdfplumber, pytesseract/Pillow). Lack of a formal install step means dependencies must be installed manually; there is no remote download or unclear install URL. No high-risk external download is present in the manifest.
ℹ 凭证需求
The required env vars (BANANA2_API_URL, BANANA2_API_KEY) are proportional to the declared image-generation functionality. The code also reads fallback vars (ACEDATA_API_KEY, PAPER_DIAGRAM_API_KEY, PAPER_DIAGRAM_LLM_URL/KEY) and SKILL.md suggests storing LLM keys — these additional credentials are optional but present in prompts and code; users should be aware the skill can use any of these if set. No unrelated cloud credentials (AWS, GCP) are requested.
✓ 持久化与权限
The skill does not request 'always: true' and is user-invocable. It does not appear to modify other skills or system-wide agent settings programmatically. It suggests the user add credentials to ~/.openclaw/openclaw.json (a recommendation), but it does not automatically persist or escalate privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/12
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install ynu-papergraphgeneration-openclaw
镜像加速npx clawhub@latest install ynu-papergraphgeneration-openclaw --registry https://cn.longxiaskill.com