by 安全扫描
OpenClaw
可疑
medium confidenceThe skill claims to automate searching, applying, and messaging on Upwork/Fiverr but provides no install spec, no credentials, and no details about how it will access accounts — these gaps make its behavior unclear and potentially risky.
评估建议
Do not install or enable autonomous actions yet. Ask the publisher for: (1) the source/repository or homepage and code provenance; (2) explicit details on how account authentication is done (OAuth, API keys, or browser automation) and what env vars or tokens are required; (3) an install spec or package URL you can inspect (the README's `npx` line is not present in the registry); (4) how lead data is stored and where; and (5) confirmation that automatic applying/messaging complies with Upwork/Fiv...详细分析 ▾
⚠ 用途与能力
The skill's stated purpose (automatically search Upwork/Fiverr, generate proposals, apply, track leads, and send outreach) requires account access (logged-in sessions or API tokens), browser automation tooling, and persistent storage for lead tracking. The registry declares no required environment variables, no config paths, and no install artifacts, which is inconsistent with those needs. SKILL.md also includes an npm install command that is not reflected in the registry metadata.
⚠ 指令范围
Runtime instructions explicitly tell the agent to search Upwork/Fiverr, filter jobs, generate proposals, apply, and send messages, but provide no mechanism (API, OAuth flow, browser automation) or limits. The instructions direct the agent to perform account-level actions (apply/send messages) and to record application status, implying access to user accounts and storage — none of which are documented or constrained. The guidance is vague and grants broad discretion.
ℹ 安装机制
The registry shows this is instruction-only with no install spec or code files, but SKILL.md suggests running `npx clawhub@latest install upwork-automation-gig`. That is inconsistent: an npx-based install would fetch and execute remote npm code, but no install spec or provenance is provided in the registry. This mismatch increases uncertainty about what code would be run if the user follows the README command.
⚠ 凭证需求
No environment variables, credentials, or config paths are declared, yet the skill needs platform authentication (Upwork/Fiverr account cookies or API tokens) and persistent storage for lead tracking. The absence of any declared credential requirements is disproportionate to the described functionality and suggests missing or undeclared credential handling.
✓ 持久化与权限
The skill does not request 'always:true' and uses default autonomous-invocation settings. There is no evidence it modifies other skills or system-wide settings. However, autonomous invocation combined with the ability to send outreach and apply to jobs increases the impact if the skill behaves unexpectedly — consider limiting autonomous permissions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/19
Upwork Automation Gig 1.0.0 – 初始版本發佈 - 自動搜尋Upwork及Fiverr上RPA、Automation、Web Scraping、Data Entry相關職位 - 分析職位並自動生成個性化專業Proposal - 記錄已申請職位及追蹤進展 - 自動聯絡潛在客戶進行外展推廣 - 提供「搵job」即時自動化流程 - 建議收費模式包括按工作、按項目及月費選擇
● 可疑
安装命令 点击复制
官方npx clawhub@latest install upwork-automation-gig
镜像加速npx clawhub@latest install upwork-automation-gig --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制