by 安全扫描
OpenClaw
可疑
medium confidence该技能的指令与其宣称目标（让智能体主动）一致，但鼓励无人值守的自主运行与外部通信，同时缺少明确的凭据/安全细节与防护栏——此差异需谨慎对待。
评估建议
This kit is coherent for turning an agent proactive, but it enables unattended, persistent activity and external communication. Before installing: 1) Audit what files and memory you will allow the agent to read/write (tasks/, memory/). 2) Require explicit credentials and least privilege for any external channels (Discord/Slack tokens, OpenClaw/cron permissions) and do not give channel posting rights to sensitive spaces. 3) Limit heartbeat frequency and token budgets, and add hard-stops/human con...详细分析 ▾
✓ 用途与能力
The name/description (proactive autonomy) align with the SKILL.md and README: reading a task queue, changing heartbeat behavior, scheduling cron jobs and coordinating via team channels is coherent with the stated purpose.
⚠ 指令范围
Runtime instructions explicitly tell agents to read and update local files (tasks/QUEUE.md, memory/YYYY-MM-DD.md), post to team channels (Discord/Slack), spawn/team agents, and create cron jobs that run unattended. These are powerful operations and the SKILL.md gives broad discretion ("Do meaningful work", "Pick the highest-priority task you can do") without concrete limits on what data can be read, modified, or transmitted.
✓ 安装机制
Instruction-only skill (no install spec, no code files). Low install risk because nothing will be downloaded or written by the installer itself. All behavior comes from instructions the agent will follow at runtime.
⚠ 凭证需求
The docs instruct posting to Discord/Slack and using openclaw cron commands, and reference memory and agent configuration; yet the skill declares no required environment variables or credentials. That omission is risky: agent-to-channel posting and cron/session management will require tokens or platform permissions which are not documented here, creating a gap between required runtime access and declared requirements.
ℹ 持久化与权限
always:false (good). However the skill explicitly recommends creating cron jobs and persistent heartbeats that run autonomously (overnight cron entries, frequent heartbeats and spawn behaviors). Autonomous invocation plus scheduled jobs increases blast radius if agents are granted broad access — this is expected for an autonomy kit but users should treat it as a high-privilege configuration change.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/18
- 初始发布 agent-autonomy-kit。 - 让智能体无需等待提示即可主动工作。 - 引入带状态追踪的任务队列系统。 - 支持自动心跳以持续处理任务。 - 提供任务、心跳与自动调度的模板，便于快速设置。
● 可疑
安装命令
点击复制官方npx clawhub@latest install agent-autonomy-kit-skip
镜像加速npx clawhub@latest install agent-autonomy-kit-skip --registry https://cn.longxiaskill.com
技能文档
# Agent Autonomy Kit 将你的 agent 从被动转为主动。 ## 快速开始 1. 创建 tasks/QUEUE.md，包含 Ready/In Progress/Blocked/Done 四个区域 2. 更新 HEARTBEAT.md，使其从队列中拉取任务并执行 3. 设置 cron job，实现夜间运行与每日报告 4. 无需提示，即可看到工作自动推进 ## 核心概念 - Task Queue —— 始终有任务待命 - Proactive Heartbeat —— 主动执行，而非仅检查 - Continuous Operation —— 持续运行，直到触发限制 完整文档请见 README.md