by 安全扫描
OpenClaw
安全
medium confidence该技能完全实现了其所声称的功能（本地 SKILL.md 浏览器），没有意外的外部安装或凭据请求，但在运行前需检查几项可能存在风险的操作选择。
评估建议
This skill is coherent with its description and contains only local code, but review and consider these before running: 1) The included launcher script will forcibly kill whatever is listening on port 8765 (kill -9) — that can stop unrelated services; consider removing or modifying that line. 2) The Python server binds to 0.0.0.0 (all interfaces) and serves SKILL.md contents over HTTP — change the bind to 127.0.0.1 if you only want local access, and ensure SKILL.md files do not contain secrets. ...详细分析 ▾
✓ 用途与能力
Name/description match the code: server.py enumerates directories under a parent SKILL_DIR, parses SKILL.md frontmatter and serves a web UI to list and view skill details. There are no unrelated environment variables, external services, or surprising dependencies required.
ℹ 指令范围
SKILL.md tells the user to run the provided script and open http://127.0.0.1:8765. The included script/server implement that behavior and read SKILL.md files from a directory two levels up. That is expected for a skills browser, but the runtime will read and serve the contents of SKILL.md files over HTTP — any sensitive data placed in SKILL.md will be exposed. Also the server binds to 0.0.0.0 (all interfaces) rather than localhost, which increases network exposure.
✓ 安装机制
No install spec or external downloads; all code is bundled with the skill (Python script, HTML, third-party JS libs). Nothing is fetched from arbitrary URLs and no archives are extracted at install-time.
ℹ 凭证需求
The skill requests no env vars or credentials. However it scans the filesystem (SKILL_DIR) for SKILL.md files and will expose their contents over its HTTP endpoints. That filesystem access is proportionate to the stated purpose but you should ensure the scanned directory does not contain secrets or private SKILL.md content you don't want served.
✓ 持久化与权限
The skill does not request persistent/privileged platform flags (always:false) and does not modify other skills. Operational behaviors to be aware of: the shell script kills any process using port 8765 (lsof | xargs kill -9) before starting the server, which can terminate unrelated services on that port; server binds to 0.0.0.0 and calls webbrowser.open to launch a browser.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/15
ai-skills-browser 1.0.0 – 首次发布技能浏览器工具，基于 HTML 与 Python3 实现。 – 支持对 ../skills/ 目录内技能进行列表过滤。 – 可浏览并查看每个技能的详细信息。 – 提供本地 Web 页面访问与操作体验。
● 无害
安装命令
点击复制官方npx clawhub@latest install ai-skills-browser
镜像加速npx clawhub@latest install ai-skills-browser --registry https://cn.longxiaskill.com
技能文档
../skills/目录内的技能管理工具，支持技能列表过滤和详情查看。
# 功能
- 技能列表过滤
- 技能详情查看
# 安装
- 运行skillsbrowser脚本
- 访问http://127.0.0.1:8765查看技能浏览器
- 从浏览器中输入技能名称进行过滤
- 点击技能名称查看详细信息
- 从浏览器中关闭技能浏览器