rh-skill

RunningHub AI 智能调用。Use when user wants to generate images, videos, or audio content.

This skill is a wrapper around a separate project (RHMCP) and asks you to clone and run that external code. That means: 1) Inspect the RHMCP repository and the included executor.mjs before running npm install or node — running npm install/build executes arbitrary third-party code. 2) Be cautious where you set RHMCP_CONFIG and create service.json/.env — the executor reads files from those directories (apps.json, service.json) and could process any local config placed there. 3) The only declared credential is RUNNINGHUB_API_KEY (expected), but the code also uses RHMCP_CONFIG (not declared); avoid pointing it at directories that contain other secrets. 4) Prefer testing in an isolated environment (container or VM), and avoid running these install steps as root. 5) If you want minimal risk, request a version of the skill that calls RunningHub APIs directly (no external repo clone) or provide an official install package/release rather than free-form git clone + npm install.

Type: OpenClaw Skill Name: runninghub-skill Version: 1.0.0 The skill bundle is a legitimate integration for the RunningHub AI platform, providing an AI agent with the necessary logic and metadata to generate images, videos, and audio content. The SKILL.md file contains clear instructions for the agent on mapping user requests to specific tool calls and managing multi-step workflows, while the executor.mjs script serves as a helper for configuration management and decision-making. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found, and all components are consistent with the stated purpose of the skill.