首页龙虾技能列表 › Domain Check — 通过 Vercel 检查和购买域名

Domain Check — 通过 Vercel 检查和购买域名

v1.0.0

通过 Vercel 检查域名可用性、价格,并购买/管理域名。支持交互式购买和 API 直接调用,适用于开发者快速获取和管理域名。

0· 453·3 当前·3 累计
by @brennerspear (BrennerSpear)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/12
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
high confidence
该技能目的明确(通过 Vercel 检查和购买域名),但运行时指令访问敏感本地凭据和环境值而未声明,且允许交互式购买命令 — 安装前应了解此重要不匹配。
评估建议
该技能看似功能如其宣称(Vercel 域名检查和购买),但运行时指令预期访问 Vercel CLI 令牌和团队配置文件(或 VERCEL_TOKEN / VERCEL_TEAM_ID),尽管技能元数据未列出任何必需凭据。安装/启用前:1) 验证技能源和可信度(无主页,所有者未知)。2) 谨慎提供文件系统访问或允许自动运行可能读取 ~/.local/share/com.vercel.cli/auth.json 并使用该令牌。3) 确保 npx、jq、curl 和 Vercel CLI 存在;确认技能声明这些要求或在受限环境中运行。4) 若不想意外购买,禁止交互式执行或要求手动确认任何购买/POST 操作。5) 要求技能元数据更新以声明 VERCEL_TOKEN/VERCEL_TEAM_ID 要求(或明确声明将读取 Vercel CLI 文件),以便您做出明知的权限决定。...
详细分析 ▾
用途与能力
The name/description match the SKILL.md: it uses the Vercel CLI and Vercel Registrar API to check availability and buy domains. However, the skill does not declare any required credentials or env vars even though the instructions clearly require a Vercel token/team ID and CLI authentication. That omission is a material inconsistency.
指令范围
The SKILL.md explicitly instructs the agent to read the Vercel CLI auth file (~/.local/share/com.vercel.cli/auth.json) and config (~/.local/share/com.vercel.cli/config.json) or to use a VERCEL_TOKEN/VERCEL_TEAM_ID env var. It also demonstrates exec(...) calls (including interactive buys with pty:true) and curl POSTs that would actually purchase domains. These instructions access local credential files and allow high-impact actions (purchasing domains) that are not declared in the skill metadata.
安装机制
There is no install spec and no code files; this instruction-only approach minimizes disk-write risk. However, the instructions assume external tooling (npx, jq, curl, Vercel CLI) that the environment must have, which is not declared in required binaries.
凭证需求
The skill requires a Vercel token and (optionally) a team ID to operate, and it demonstrates reading those from local files — yet requires.env and primary credential are empty. It also references jq, npx and curl but none are listed as required binaries. Requesting or reading tokens is expected for this purpose, but failing to declare them is a proportionality/visibility problem and increases risk of accidental credential access/exfiltration.
持久化与权限
The skill does not request always:true and does not modify other skills or system configs. It can invoke interactive commands (buy flows), which is normal for its purpose, but that capability combined with undeclared credential access raises risk — the permission model is otherwise standard.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.02026/2/25

初始发布

● 可疑

安装命令 点击复制

官方npx clawhub@latest install domain-check
镜像加速npx clawhub@latest install domain-check --registry https://cn.clawhub-mirror.com

技能文档

检查域名可用性、价格,并通过 Vercel 购买/管理域名。

快速参考

# 检查名称在多个 TLD下的可用性和价格
域名检查 myproject
# 检查特定 TLD
域名检查 myproject com,io,dev,app,ai
# 购买域名(交互式 — 需要 pty:true)
npx vercel 域名购买 mydomain.com
# 列出拥有的域名
npx vercel 域名列表
# 检查拥有的域名
npx vercel 域名检查 mydomain.com
# 将域名添加到 Vercel 项目
npx vercel 域名添加 mydomain.com my-project
# 将域名转入 Vercel
npx vercel 域名转入 mydomain.com
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务