GPT聊天 - 使用GPT模型进行对话和内容生成

This skill is a local Node-based GPT client and will ask for your OpenAI API key. Before installing or running it: (1) do not paste your API key into chat — set OPENAI_API_KEY as an environment variable instead; (2) inspect and change any API base to the official https://api.openai.com if you intend to use OpenAI directly — several scripts default to api.openai-proxy.org which could forward your key/requests to a third party; (3) if you already supplied a key while trying this skill, treat it as compromised and rotate it; (4) run the skill in an isolated environment and review network traffic (or the skill author’s explanation) if you need to trust a proxy endpoint. The code otherwise matches the described functionality, but the non-official proxy default and the encouragement to paste keys in conversation are the main security concerns.

Type: OpenClaw Skill Name: gpt-chat Version: 1.0.0 The skill is classified as suspicious due to the use of a third-party proxy (api.openai-proxy.org) as the default endpoint for the OPENAI_API_KEY in gpt.js and generate-article.js, which risks exposing sensitive credentials to an unofficial intermediary. Furthermore, the documentation (SKILL.md) deceptively claims to support non-existent 'GPT-5.1' and 'GPT-5.2' models with specific pricing, acting as a misleading lure for users to provide their API keys. The bundle also includes an unadvertised local HTTP server (server.js) that exposes API functionality on port 3456, which could allow unauthorized local network access to the user's configured credentials.