统计文本高频短语并输出前 N 项。

This skill is internally inconsistent: it advertises phrase counting but the shipped script doesn't implement that and includes undocumented network calls. Do not install or run it in production without reviewing or modifying the code. Recommended actions: (1) Inspect main.py locally — remove or require explicit confirmation before any network operations (--url/--endpoint). (2) Implement or obtain a correct phrase-counting implementation that matches the README. (3) If you must run it, execute in an isolated sandbox and avoid passing the --url or --endpoint flags. (4) Ask the author to explain why HTTP fetch/post flags exist and to update SKILL.md to list all CLI options and their purpose.

Type: OpenClaw Skill Name: keyphrase-counter Version: 1.0.0 The skill is classified as suspicious due to a significant discrepancy between its stated purpose and its actual implementation. While SKILL.md and the metadata describe a 'keyphrase-counter' for text processing, main.py contains no logic for counting phrases. Instead, it functions as a generic HTTP client with undocumented arguments (--url, --endpoint, --payload) that allow fetching remote content or POSTing local file data to arbitrary external servers. This hidden functionality facilitates data exfiltration and remote access, which is not disclosed in the skill's documentation.