安全扫描
OpenClaw
安全
high confidenceThe skill's code and instructions match its stated purpose (installing/configuring/monitoring mihomo proxies); it downloads a mihomo release, writes user config, and can install a system service — behavior is coherent but carries the expected privileged/install risks.
评估建议
This skill appears to do what it says: it downloads the mihomo release from GitHub, writes config files under your home config directory, and can install a systemd/launchd service (it may prompt for sudo). Consider these before installing: (1) installing will place and execute a downloaded binary — verify the upstream project/release and checksum if possible; (2) the installer may attempt to write a system service and request sudo, and the service unit requests network capabilities (CAP_NET_ADMI...详细分析 ▾
✓ 用途与能力
Name/description match implementation: code implements installing mihomo, parsing subscriptions (vmess/ss/trojan/vless), generating YAML configs, starting/stopping the daemon and running a watchdog. No unrelated credentials, binaries, or config paths are requested.
ℹ 指令范围
SKILL.md instructions accurately reflect runtime behavior (install, config, add, start/stop, watch). One omission: SKILL.md does not explicitly say that installing may require sudo or will create system services/launch agents; the code attempts to write systemd unit files (via sudo tee) and/or user launch agents.
ℹ 安装机制
No OpenClaw install spec, but the package code downloads binaries from GitHub releases (https://api.github.com/repos/MetaCubeX/mihomo/releases/latest) and extracts them locally — GitHub releases is a standard host, but this involves extracting and placing executables on disk and running shell tools (gunzip/unzip/mv).
✓ 凭证需求
The skill requests no special environment variables or secrets. It uses standard OS config paths (XDG_CONFIG_HOME/APPDATA) and home directory. It does reference process.env values for locating config dirs but does not require unrelated credentials.
ℹ 持久化与权限
The skill does not force permanent inclusion (always:false). However, the installer can create system-level services (writes to /etc/systemd/system via sudo) or user launch agents and may set service capabilities (AmbientCapabilities in the unit). Installing as a service or extracting an executable requires elevated actions and is therefore privileged in effect.
⚠ src/configure.js:132
Shell command execution detected (child_process).
⚠ src/install.js:65
Shell command execution detected (child_process).
⚠ src/platform.js:39
Shell command execution detected (child_process).
⚠ src/service.js:40
Shell command execution detected (child_process).
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.2.02026/4/2
v0.2.0: Hardening release — atomic config writes, YAML validation, timeouts, shell injection fixes, graceful shutdown. 15 issues fixed.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install claw-use-mihomo
镜像加速npx clawhub@latest install claw-use-mihomo --registry https://cn.clawhub-mirror.com
技能文档
Manage mihomo proxy: install, configure from subscriptions, monitor health, auto-switch nodes.
When to use
- User asks to set up a proxy/VPN on their machine
- User provides a subscription URL, vmess://, ss://, trojan://, or vless:// link
- Proxy stops working and needs diagnosis/fix
- User wants to switch proxy nodes or check status
Prerequisites
- Node.js >= 18
- Network access to download mihomo binary
Setup
npx mihomod install
Commands
Install mihomo
npx mihomod install
Configure from subscription
npx mihomod config "https://example.com/subscribe?token=xxx"
Config is validated (YAML parse + structure check) before writing. Old config is backed up to .bak.Add single node
npx mihomod add "vmess://eyJ..."
npx mihomod add "ss://..."
npx mihomod add "trojan://..."
npx mihomod add "vless://..."
Start/stop mihomo
npx mihomod start
npx mihomod stop
Check status
npx mihomod status --json
Returns: {"running":true,"node":"...","delay":150,"alive":42,"total":50}List nodes
npx mihomod nodes --json
Switch node
npx mihomod switch # auto-select best
npx mihomod switch "node-name" # specific node
Start watchdog
npx mihomod watch
Monitors endpoints, auto-switches on failure. Outputs JSON events to stdout. Handles SIGTERM/SIGINT gracefully.Config
Located at~/.config/mihomod/config.json. Created automatically on first run.
Edit to set mihomo API URL, watchdog endpoints, node priorities, etc.Safety
- Config writes are atomic: write to
.tmp→ validate YAML + structure → rename (old config backed up to.bak) - Subscription content is validated before writing — malformed YAML is rejected
- All network calls have timeouts (API: 5s, subscriptions: 30s, downloads: 120s)
- Subscription downloads capped at 10MB
All output is JSON
All commands output structured JSON (human-readable on TTY). Exit codes: 0=success, 1=error, 2=config error, 3=network error.数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制