by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is mostly coherent for creating leads (it posts PII to an external API with an API key), but the registry metadata omits the required AGENTICCREED_API_KEY and there are privacy/third‑party data concerns you should review before installing.
评估建议
Before installing: 1) Verify the external endpoint (https://gateway.agenticcreed.ai) and the skill author are trustworthy — the homepage and owner metadata provide little context. 2) The skill sends personal data (address, DOB, phone) to a third party; confirm that you are allowed to share this data and understand retention/policy. 3) Provide an API key with least privilege and short lifetime; store AGENTICCREED_API_KEY securely. 4) Note the registry omitted the required env var — be sure the pl...详细分析 ▾
ℹ 用途与能力
The SKILL.md and SKILL.yaml consistently describe creating a signup lead by POSTing lead fields to https://gateway.agenticcreed.ai/signup-leads with an x-api-key header. That matches the stated purpose. However, the registry metadata earlier listed 'Required env vars: none' while the skill clearly expects AGENTICCREED_API_KEY — an incoherence between declared requirements and the instruction files.
✓ 指令范围
Runtime instructions only describe sending the provided lead fields (email, name, address, DOB, phone, etc.) to the external HTTP endpoint and require an API key. The instructions do not ask the agent to read unrelated files, credentials, or system state. Important note: the skill transmits sensitive personal data (PII) to a third‑party endpoint, so data‑handling and retention are relevant concerns.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files, so it does not download or install binaries. That minimizes code‑injection risks.
⚠ 凭证需求
Requesting a single service API key (AGENTICCREED_API_KEY) is proportionate to the task. The concern is that the registry metadata did not list this required environment variable while both SKILL.md and SKILL.yaml explicitly require it (x-api-key: {{env.AGENTICCREED_API_KEY}}). This mismatch could lead to confusion or accidental exposure if users are not warned. Also, the API key will authorize sending PII to a remote service — you should confirm the key's scope and lifecycle.
✓ 持久化与权限
The skill does not request persistent/always-on privileges (always:false) and does not modify other skills or system configuration. It uses normal autonomous invocation defaults only.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/11
Initial release: Enables creation of signup leads via AgenticCreed API. - Sends contact details (email, name, phone, etc.) to the AgenticCreed signup-lead endpoint. - Supports parameters for key personal and contact information. - Requires the AGENTICCREED_API_KEY environment variable for authentication.
● 无害
安装命令 点击复制
官方npx clawhub@latest install signup-lead
镜像加速npx clawhub@latest install signup-lead --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制