by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is mostly a simple front-end JSON diff tool (which appears coherent), but the SKILL.md encourages using remote hosted URLs instead of the bundled local HTML — that discrepancy and reliance on external endpoints is the main risk.
评估建议
This skill appears to be a small, local, front-end JSON diff utility (the included index.html contains the expected parsing/diff code). The main concern is that the SKILL.md tells users to open remote URLs (clawhub.ai and a trycloudflare subdomain) rather than explicitly using the bundled local file. Remote hosts can change code or add analytics/ads/exfiltration later, which would break the 'data not uploaded' claim. Before installing or using: (1) prefer opening and using the bundled index.html...详细分析 ▾
ℹ 用途与能力
The name/description match the included functionality: a small, pure front-end JSON diff UI that claims to process data locally. The shipped index.html contains the expected JS for parsing and diffing. However, SKILL.md lists remote URLs (clawhub.ai, a trycloudflare subdomain, and a GitHub repo) as the primary ways to 'start' the tool instead of telling the user/agent to open the bundled local file. That difference is notable because the remote sites could serve different code than the included index.html.
⚠ 指令范围
Runtime instructions direct users/agents to visit external URLs (including a trycloudflare subdomain). The SKILL.md asserts 'data not uploaded', but the instructions' emphasis on remote hosted pages means users might paste data into a site you don't control. The SKILL.md does not instruct the agent to inspect or prefer the local index.html bundle before directing users to the remote site, creating scope for surprising remote behaviour (analytics, ad scripts, or exfiltration) that contradicts the privacy claim.
✓ 安装机制
No install spec and no required binaries or environment variables — the skill is instruction-only (and ships a local HTML file). This is low risk from an install-perspective because nothing is written or executed on disk by an installer.
✓ 凭证需求
The skill requests no environment variables, credentials, or config paths and its stated functionality (pure front-end JSON diff) does not require secrets. That is proportionate.
✓ 持久化与权限
The skill is not always-on and does not request elevated or persistent agent privileges. Autonomous invocation is allowed (the platform default), which is normal for skills, and does not by itself increase the risk here.
安装前注意事项
- prefer opening and using the bundled index.html locally (or review its full source) rather than pasting sensitive JSON into the remote site; (
- if you must use the remote URL, manually inspect that remote page's source (or the GitHub repo) to ensure it matches the bundled index.html; (
- avoid pasting secrets (API keys, full responses containing credentials) into any web-based tool unless you trust the host; (
- note the minor metadata inconsistency: the skill was labeled 'instruction-only' but does include an index.html — verify the shipped files if you rely on local-only behavior.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/7
- Initial release - Supports path-level JSON diff with syntax highlighting - All processing is done locally—no data uploaded - Swappable, copyable sides and preset sample data - Keyboard shortcut (Ctrl+Enter) for quick comparison
● 无害
安装命令 点击复制
官方npx clawhub@latest install json-diff-tool
镜像加速npx clawhub@latest install json-diff-tool --registry https://cn.clawhub-mirror.com
技能文档
描述
免费的在线 JSON 对比工具，支持语法高亮、路径级别差异分析、数据不上传服务器。快速找出两个 JSON 之间的差异，适用于 API 响应对比、配置文件对比、测试数据对比等场景。
触发词
- "json diff"
- "json对比"
- "json比较"
- "json差异"
- "比较两个json"
- "diff json"
- "json 区别"
使用方式
当用户请求 JSON 对比、JSON 差异、JSON 比较时，直接调用本技能。
1. 启动工具
用户访问以下任一 URL：
主工具: https://clawhub.ai/skills/json-diff-tool
直接访问: https://phil-sell-atlantic-weddings.trycloudflare.com/tools/json-diff/
GitHub: https://github.com/shenghoo123-png/json-diff-tool
2. 功能说明
- 左侧 JSON A: 粘贴第一个 JSON
- 右侧 JSON B: 粘贴第二个 JSON
- 点击「对比」查看差异
- 支持交换左右两侧内容
- 支持复制结果
- 预置示例数据一键加载
- 键盘快捷键: Ctrl+Enter 对比
3. 差异展示
- 绿色高亮: 新增的字段 (B 独有)
- 红色高亮: 删除的字段 (A 独有)
- 灰色: 未变化的字段
- 路径格式:
$.name,$.users[0].email,$.data.settings.theme
技术实现
- 纯前端 HTML/CSS/JavaScript，无框架依赖
- 文件大小 < 15KB
- 数据完全在本地处理，不上传服务器
- 支持深层嵌套对象和数组
- 路径查询语法:
$.key,$.arr[0],$.obj.nested
示例场景
API 响应对比
// 线上环境
{"status":"ok","data":{"users":3}}// 测试环境
{"status":"ok","data":{"users":5}}
// 差异: data.users 从 3 变成 5
配置文件对比
// v1.0
{"version":"1.0","debug":false,"timeout":3000}// v1.1
{"version":"1.1","debug":false,"timeout":5000}
// 差异: version 从 1.0 变成 1.1, timeout 从 3000 变成 5000
适用人群
- 后端开发者: 对比 API 响应差异
- 测试工程师: 验证接口返回是否符合预期
- 运维/DBA: 对比配置文件变更
- 产品经理: 对比不同版本的数据结构
替代方案
如需更强大的 JSON 查询功能（路径提取、过滤、转换），可使用 JSON Query Tool。
更新日志
v1.0.0
- 初始版本
- 支持路径级别差异对比
- 纯前端实现，数据不上传
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制