by 安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to do what it says (create agent folders and files and wire Telegram), but there are several inconsistencies and missing declarations that should be resolved before running it (missing referenced script, undeclared Telegram credential requirement, and unclear provenance).
评估建议
What to check before installing/running:
1) Do not run the scripts without inspection. The bundled scripts create and overwrite files under $HOME/.openclaw/agents and will embed the Telegram group ID into MEMORY files — back up your existing OpenClaw agents first.
2) The SKILL.md/README say a Telegram Bot Token is needed, but the package metadata does not declare any required env var. Treat the token as a secret: configure it in your gateway (not in these plaintext files) and avoid pasting the ...详细分析 ▾
ℹ 用途与能力
The name/description match the included script: the bundle creates agent directories, SOUL/MEMORY/HEARTBEAT files and suggests binding to Telegram via OpenClaw. Requiring the openclaw binary is coherent with the gateway restart step. However, the SKILL.md and README state a need for a Telegram Bot Token and other configuration but the registry metadata lists no required env vars or credentials — that's an inconsistency. The README and docs reference additional install mechanisms (clawhub) and marketplace links but there is no install spec in the package.
ℹ 指令范围
SKILL.md instructs running scripts/create-company.sh (included) and scripts/create-employee.sh (referenced but not present). The runtime instructions also show examples calling sessions_send/sessions_spawn and restarting the openclaw gateway; those are reasonable for coordinating agents, but the instructions assume the user will supply Telegram credentials and gateway config even though the package does not declare or securely handle them. The instructions do not attempt to read unrelated system files, nor do they call external endpoints directly in the provided script.
✓ 安装机制
There is no install spec (instruction-only plus local scripts). That lowers supply-chain risk because nothing is downloaded during install. The only script is a local shell script that writes files under $HOME/.openclaw/agents. No remote downloads or obscure install URLs are present.
⚠ 凭证需求
The SKILL.md explicitly lists 'Telegram Bot Token' and Telegram group as requirements, and asks for basic shell permissions, yet the skill metadata declares no required environment variables or primary credential. This mismatch is important: the skill will need a Telegram bot token and gateway configuration to function, but it does not request them formally or show how to store them. Also scripts write to $HOME/.openclaw/agents and will embed the provided Telegram group ID into memory files, so secrets/config could end up in plaintext files.
✓ 持久化与权限
always is false and the skill does not request system-wide privileges. The script creates files under the user's OpenClaw workspace ($HOME/.openclaw/agents) and suggests restarting the OpenClaw gateway — these are expected for this purpose but can affect running agents. The skill does not attempt to modify other skills' configs or persist beyond its directory.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/3/3
增加 README 销售文档，添加定价信息，优化产品描述
● 可疑
安装命令
点击复制官方npx clawhub@latest install ai-company-starter
镜像加速npx clawhub@latest install ai-company-starter --registry https://cn.longxiaskill.com