by 安全扫描
OpenClaw
安全
medium confidenceThe skill is internally consistent with being a drop-in React/Next.js agent UI, but the runtime instructions request an API key and remote installs that are not declared in the registry metadata — review sources and the INFERENCE_API_KEY usage before installing.
评估建议
This appears to be a legitimate UI component for building agent interfaces, but check a few things before installing: (1) Verify the source URLs and npm package (@inferencesh/sdk) on the public registries (npm, the inference.sh domain) to ensure they are the expected projects. (2) Inspect the agent.json that npx will fetch (and any code it adds) before running it in your app. (3) The SKILL.md requires INFERENCE_API_KEY but the registry metadata doesn't declare it — confirm which API key is neede...详细分析 ▾
✓ 用途与能力
Name/description match the instructions: this is a UI component for React/Next.js that uses an API proxy and an SDK. Declared runtime steps (npx shadcn template, install @inferencesh/sdk, add a Next.js proxy route) are coherent with building an agent UI.
ℹ 指令范围
SKILL.md instructs running npx to fetch a remote agent.json and npm install of @inferencesh/sdk and shows adding an .env.local INFERENCE_API_KEY and a Next.js proxy route. The instructions do not request unrelated system files or broad data exfiltration, but they do instruct pulling third-party code at install time and storing an API key in .env.local.
ℹ 安装机制
This is an instruction-only skill (no install spec). The install steps use npx shadcn@latest add https://ui.inference.sh/r/agent.json and npm install @inferencesh/sdk — pulling code from inference.sh and npm is expected for this purpose, but those are network operations that will fetch code into your project (review the fetched JSON/package before running).
⚠ 凭证需求
Registry metadata lists no required env vars, but SKILL.md explicitly instructs adding INFERENCE_API_KEY in .env.local. This mismatch reduces transparency. Also the example agent_config references an external model (openrouter/claude-haiku-45), which could require a different service key; the SKILL.md does not clearly state which credential(s) are required or their scope.
✓ 持久化与权限
Skill does not request always:true, does not declare special config paths, and is user-invocable. It does not ask to modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.52026/2/5
- Added SKILL.md with an overview, setup instructions, and feature list for the agent-ui React/Next.js component. - Documents installation, environment setup, and usage with code examples. - Lists key features: drop-in agent, tool lifecycle, human-in-the-loop, real-time streaming, and client-side tools. - Provides details on props, related skills, and links to further documentation.
● 可疑
安装命令
点击复制官方npx clawhub@latest install agent-ui
镜像加速npx clawhub@latest install agent-ui --registry https://cn.longxiaskill.com