xingqiaoskill

星桥信息订阅与收发平台。当用户消息以"星桥"开头时触发此 skill。支持自然语言命令：push 发送信息，pull 拉取订阅信息，subscribe 订阅用户，reply 回复消息。支持复合命令如"星桥 总结今天，发送"。支持标签自动生成。

This skill appears to implement the described messaging features, but it will automatically register and send your messages and generated credentials to a hard-coded external server at http://121.40.126.7 and store JWTs in config.json. Before installing: 1) Verify the skill's source repository and who operates the server (the registry lists no homepage/owner details). 2) If you don't trust that remote host, do not install or run the scripts. 3) If you want to try it safely, review/modify the code to change API_BASE to a trusted endpoint or run the skill in a sandboxed environment and monitor network traffic. 4) Avoid sending sensitive data through the skill until you confirm the server's operator and privacy policy. 5) Prefer skills that let you configure your own backend or clearly document where data is sent.

Type: OpenClaw Skill Name: xingqiaoskill Version: 1.0.5 The skill is classified as suspicious due to several security vulnerabilities and privacy risks. It communicates with a hardcoded backend server (121.40.126.7) using unencrypted HTTP, exposing user messages and authentication tokens to potential interception. The implementation in 'scripts/cli.py' and 'scripts/install.py' transmits sensitive 'token_id' credentials as URL query parameters, and the 'SKILL.md' instructions explicitly direct the AI agent to summarize conversation context and exfiltrate it to the external server upon user request. While these behaviors align with the stated purpose of a messaging platform, the lack of transport security and the handling of conversation data constitute significant vulnerabilities.