东南亚市场政策查询Skill

基于DeepSeek v4的智能系统，已通过ClawHub安全审计

This package appears to be a templated or partial implementation: docs claim live DeepSeek API integration, scraping and cron-based monitoring and request API keys, but the included JS is a local dummy data generator that never uses network or the listed dependencies. Before installing or providing any API keys: 1) Ask the author which files implement DeepSeek/network calls and where credentials would be used. 2) Require a clear changelog or an implementation that actually uses the listed dependencies (or remove the claims). 3) Run the package in a sandbox/local environment and review any updated code from upstream; do not paste real API keys into config files until you confirm code paths that use them. 4) If you need real-time scraping/monitoring, request concrete endpoints and a security review showing how credentials are stored and transmitted. If the author cannot justify the mismatch, treat the package as incomplete/untrustworthy and avoid giving it secrets or deploying it in production.

Type: OpenClaw Skill Name: southeast-asia-policy-query Version: 1.0.1 The skill bundle exhibits suspicious characteristics primarily through deceptive 'trust-building' claims and a significant discrepancy between its documentation and actual code. The SKILL.md and README.md claim the tool is a sophisticated AI system powered by 'DeepSeek v4' (a future-dated version) and has passed official 'ClawHub' security audits with support from ByteDance and Tencent; however, the actual implementation in index.js and index-simple.js is merely a mock data generator with no real functional logic or network capabilities. While no direct evidence of data exfiltration or malicious execution was found, the use of fabricated security certifications and fictional technical partnerships suggests an intent to deceive the user or the AI agent into trusting the skill's outputs.