安全扫描
OpenClaw
安全
medium confidence该技能的声明、所需凭证和运行指令在内部一致,适用于付费的网络数据分析服务,但应验证外部服务并谨慎处理支付凭证。
评估建议
该技能对于付费远程数据分析API是一致的,但安装前应谨慎:1) 验证运营商/域名(ai-service-hub-15.emergent.host)和审查其隐私/条款——您的数据将被传输到外部。2) 将 NEXUS_PAYMENT_PROOF视为敏感凭证:不要在无法轮换的环境变量中存储私钥,并不要让代理以您的名义签署交易。3) 使用 X-Payment-Proof:先使用 sandbox_test 或非敏感数据测试以确认行为和成本。4) 如果需要发布已签署的Stellar XDR,请在本地签署并仅提交已签署的XDR;永远不要暴露您的秘密密钥。5) 如果对提供商的可信度不确定,请不要安装;考虑使用本地/离线分析器instead。...详细分析 ▾
✓ 用途与能力
Name/description (data profiling) align with instructions that call a remote NEXUS API and require a payment proof; requiring a payment credential (NEXUS_PAYMENT_PROOF) is coherent for a paid API.
ℹ 指令范围
SKILL.md only instructs network calls to a single external host (https://ai-service-hub-15.emergent.host) and the use of payment headers; it explicitly disallows filesystem and shell access. Caution: it asks you to POST signed Stellar XDRs for fee sponsorship and include payment proofs in headers — these operations can expose payment-related sensitive data if misused, so avoid providing private keys to the agent and prefer sandbox_test for initial tests.
✓ 安装机制
No install spec and no code files (instruction-only) — nothing will be written or executed locally by the skill itself, which reduces installation risk.
ℹ 凭证需求
The skill requests one environment variable (NEXUS_PAYMENT_PROOF) as the primary credential. That single secret is proportionate to a paid API, but it is sensitive payment material; the README/SKILL.md justifies it for legacy header usage but does not describe its format or security handling.
✓ 持久化与权限
Skill is not always-enabled and does not request persistent platform privileges or attempt to modify other skills or system config. Agent autonomous invocation is allowed (platform default) but not a special privilege here.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/13
添加x402支付协议(Coinbase/Masumi),多链Cardano + Stellar文档,10个协议
● 无害
安装命令 点击复制
官方npx clawhub@latest install nexus-data-profile
镜像加速npx clawhub@latest install nexus-data-profile --registry https://cn.clawhub-mirror.com
技能文档
使用场景
使用时:需要对数据进行统计建模和质量评估。 ... (中间内容保持原文未翻译,仅示例) ...安全与隐私
- 所有数据通过HTTPS/TLS发送到
https://ai-service-hub-15.emergent.host。 - 无数据永久存储;请求处理后即丢弃。
- 支付证明通过Cardano区块链上的Masumi协议进行验证。
- 无需文件系统访问或shell执行。
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制