Login DigitalMe — DigitalMe 登录
v1.0.0DigitalMe 登录工具。
0· 46·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's runtime instructions match an SMS-login helper, but the registry metadata requests an odd environment variable (an IP:port string) instead of the declared SMS_LOGIN_BASE_URL, which is inconsistent and unexplained.
评估建议
This skill's behavior (calling an SMS API via SMS_LOGIN_BASE_URL) matches its description, but the package metadata incorrectly lists a required environment variable named '180.184.28.174:30080' and marks that as the primary credential. Before installing or using it: 1) ask the author to correct the metadata so the required env var is SMS_LOGIN_BASE_URL (not an IP literal), and confirm what backend that variable should point to; 2) verify the API host is trusted (don't point SMS_LOGIN_BASE_URL t...详细分析 ▾
⚠ 用途与能力
The SKILL.md behavior (using curl+jq to call an API at SMS_LOGIN_BASE_URL to send/login with SMS codes) is coherent for an SMS-login helper. However, the declared required env var and primaryEnv are set to the literal '180.184.28.174:30080' (an IP:port), which does not match the SKILL.md's documented SMS_LOGIN_BASE_URL. That mismatch is unexpected and disproportionate to the stated purpose.
✓ 指令范围
The instructions are narrowly scoped: confirm phone from user, POST to /send and /login endpoints, parse JSON with jq, extract token from data.token, and avoid exposing full tokens. They explicitly forbid guessing phones or auto-enumerating codes. They reference only SMS_LOGIN_BASE_URL, PHONE, and CODE at runtime.
✓ 安装机制
Instruction-only skill with no install spec and no code files; required binaries are only curl and jq. This is low install risk and appropriate for a curl-based API helper.
⚠ 凭证需求
The skill declares a required env var named '180.184.28.174:30080' and lists that as primaryEnv, but SKILL.md expects SMS_LOGIN_BASE_URL. Requiring an IP:port string as an env var name is incoherent and may indicate misconfiguration or a hidden intent to force use of a specific backend. No credentials (API keys) are requested, which is reasonable, but the incorrect env-var declaration is a red flag.
✓ 持久化与权限
The skill does not request persistent/always-on presence and does not write installs or system configs; autonomous invocation is allowed (platform default) but not combined with other high-privilege requests.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/1
Initial release of SMS-based login/register skill. - Enables user login and registration via SMS verification code. - Provides commands for sending verification codes and logging in with code. - Includes clear error handling and user guidance for each step. - Enforces input validation and security-minded output rules. - Requires environment variable configuration and curl, jq dependencies.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install login-digitalme
镜像加速npx clawhub@latest install login-digitalme --registry https://cn.clawhub-mirror.com
技能文档
通过手机号和短信验证码实现用户快速登录或自动注册。
何时使用
当用户要求：发送手机验证码、用手机号登录、用验证码登录、手机号注册 时，使用此 skill。
前置条件
- 环境变量
SMS_LOGIN_BASE_URL已设置为 API 服务器地址 - 系统已安装
curl和jq
步骤一：发送验证码
向用户确认手机号后，发送验证码：
curl -s -X POST "${SMS_LOGIN_BASE_URL}/api/v1/auth/phone/send" \
-H "Content-Type: application/json" \
-d '{"phone": "'"${PHONE}"'"}' | jq .
响应判断
| 条件 | 含义 | 下一步 |
|---|---|---|
code == 200 | 发送成功 | 提示用户查看短信，进入步骤二 |
| HTTP 400 | 手机号格式错误 | 提示用户检查手机号，重新输入 |
code == 500 | 限流或系统错误 | 展示 message 内容，稍后重试 |
步骤二：验证码登录
向用户索要短信中的验证码后，发起登录：
curl -s -c - -X POST "${SMS_LOGIN_BASE_URL}/api/v1/auth/phone/login" \
-H "Content-Type: application/json" \
-d '{"phone": "'"${PHONE}"'", "code": "'"${CODE}"'"}' | jq .
响应判断
| 条件 | 含义 | 下一步 |
|---|---|---|
code == 200 | 登录成功 | 从 data.token 提取 token，后续请求用 Authorization: Bearer |
| HTTP 400 | 参数缺失/格式错误 | 提示用户重新输入 |
code == 401 | 验证码错误或已过期 | 建议用户重新获取验证码，回到步骤一 |
Set-Cookie: token=，浏览器场景会自动维持会话。Rules
- 手机号必须由用户明确提供，禁止猜测或自动填充
- 验证码必须由用户手动输入，禁止尝试自动获取或暴力枚举
- 同一手机号 60 秒内不得重复发送验证码
- 输出中不要暴露完整 令牌，最多显示前 20 个字符加省略号
- 中国大陆手机号为 11 位数字且以 1 开头，发送前先做格式校验
- 登录失败时必须向用户展示具体错误信息
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制