openspace-llm-xiaowei

把港大OpenSpace改造成OpenClaw可直接调用的AI技能，支持MiniMax-M2.7、自动代理、长文本生成

This skill appears to do what it says (adapter for OpenSpace/MiniMax) and installs with pip, but before installing you should: 1) Treat the API key printed in the README as a potential leaked secret — do not reuse it; assume it's invalid or compromised and do not paste real credentials into public files. 2) Confirm the author: the package metadata lacks declared required env vars (OPENSPACE_API_KEY) — ask the publisher to update metadata to declare required credentials. 3) Only provide your MiniMax API key to the runtime environment (e.g., .env or system env) and rotate it if you ever pasted it into this repository. 4) Review and vet the 'openspace' PyPI package source (pip install openspace) to ensure it is the official library. 5) Test the skill in an isolated environment (or sandbox) and ensure proxy settings are appropriate. If the README's key looks like one of your keys, rotate it immediately. If you need higher assurance, request the author to remove hard-coded/example secrets and to update registry metadata to list required env vars.

Type: OpenClaw Skill Name: openspace-llm-xiaowei Version: 1.0.0 The skill bundle contains a hardcoded, functional MiniMax API key (sk-cp-MaMBL...) within the README.md file, which constitutes a significant security vulnerability and credential leak. While the core logic in openspace_llm.py appears to be a legitimate wrapper for the HKUDS OpenSpace library, the inclusion of active credentials and specific local proxy configurations (127.0.0.1:10810) is highly irregular and poses a risk of monitoring or unauthorized access. No direct evidence of intentional data exfiltration or malicious backdoors was found, but the credential exposure warrants a suspicious classification.