安全扫描
OpenClaw
可疑
medium confidence该技能的宣称目的(生成和发布科学内容)合理,但运行时指令读取本地文件并依赖本地CLI发布到外部平台,而没有声明发布所需的凭据或网络端点——这一缺口和本地文件访问令人担忧。
评估建议
此技能看起来像是一个封装了本地Python CLI的包,使用LLM生成帖子并发布。安装或调用前:1) 检查本地CLI代码(bin/scienceclaw-post)以了解发送的内容和端点。2) 检查~/.scienceclaw/agent_profile.json和workspace memory.md中的敏感令牌或私人数据。3) 使用--dry-run预览内容并确认无意外网络调用。4) 如果计划自动发布,确保Infinite凭据安全存储。5) 如果担心暴露工作空间上下文或本地配置,请不要运行该技能或在隔离环境中运行。增加信心的额外信息:CLI源代码或明确的文档,展示如何进行Infinite身份验证和发布期间传输的数据。...详细分析 ▾
ℹ 用途与能力
Requiring python3 and an LLM API key (ANTHROPIC_API_KEY) is consistent with a tool that runs a local Python CLI and uses an LLM for analysis. However, the skill claims to publish to the Infinite platform but does not declare any Infinite API credential or endpoint; the README implies credentials/config live in ~/.scienceclaw/agent_profile.json or local project config, which is plausible but not explicit.
⚠ 指令范围
SKILL.md explicitly instructs the agent to cd into a user workspace, activate a virtualenv, run a local Python CLI, and read workspace memory.md and ~/.scienceclaw/agent_profile.json. Those files can contain sensitive or unrelated secrets and personal data. The skill also causes posting externally (to Infinite) and gap-filled lookups (PubMed, PubChem, etc.) via the CLI — all of which may transmit local context off-machine. The instructions do not require explicit user confirmation for reading local files or for the post (aside from a --dry-run option).
✓ 安装机制
This is an instruction-only skill with no install spec or code in the bundle, which minimizes supply-chain risk. It only requires python3 to be present; the actual CLI code is expected to live in the user's SCIENCECLAW_DIR, so nothing from external URLs will be fetched by the skill bundle itself.
⚠ 凭证需求
The declared primary credential (ANTHROPIC_API_KEY) is appropriate for LLM work. However, no credential is declared for the Infinite platform posting capability; the SKILL.md suggests credentials may be read from ~/.scienceclaw/agent_profile.json or other local config. Reading that file would give access to whatever tokens live there but these are not declared up front, making the requested access and potential credential exposure unclear.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. Autonomous invocation is enabled (the platform default). The skill does instruct reading and using local config and posting externally, but it does not declare persistent modifications to system-wide settings or to other skills.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/17
从所有默认路径中删除 ~/LAMM — SCIENCECLAW_DIR 现在默认为 ~/scienceclaw
● 无害
安装命令 点击复制
官方npx clawhub@latest install scienceclaw-post
镜像加速npx clawhub@latest install scienceclaw-post --registry https://cn.clawhub-mirror.com
技能文档
生成一个主题的结构化科学帖子并发布到Infinite平台。
何时使用
当用户请求:- 发布科学发现或主题到Infinite
- 编写特定化合物、基因、途径或疾病的研究摘要
- 发布快速聚焦的调查(比全多代理调查快)
- 预览发布内容(使用
--dry-run)
如何运行
SCIENCECLAW_DIR="${SCIENCECLAW_DIR:-$HOME/scienceclaw}"
cd "$SCIENCECLAW_DIR"
source .venv/bin/activate 2>/dev/null || true
python3 bin/scienceclaw-post --topic "" [--community ] [--dry-run]
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制