by 安全扫描
OpenClaw
安全
high confidenceThe skill's requests and instructions are coherent with its stated purpose (AI-driven SEO content generation with an optional WordPress deploy); nothing in the package asks for unrelated credentials or installs arbitrary code, but review deploy credentials and outputs before publishing.
评估建议
This skill appears to do what it says: generate large volumes of SEO content (using your Anthropic key) and optionally deploy to WordPress. Before installing/using it: 1) Ensure you have and control an Anthropic API key (the SKILL.md requires ANTHROPIC_API_KEY even though registry metadata said none). 2) If you intend to use the WordPress deploy step, create a dedicated WordPress account with the least privileges needed (Editor role if feasible) and use an Application Password; revoke it after t...详细分析 ▾
ℹ 用途与能力
The skill is an AKA-framework content generator and linking/orchestration system that uses Anthropic (claude-opus-4) for generation and optionally deploys to WordPress. Requesting an ANTHROPIC_API_KEY and optional WordPress REST credentials (WP_URL, WP_USER, WP_PASS) is proportional to the described capabilities. Note: registry metadata at the top reported 'Required env vars: none' while SKILL.md lists ANTHROPIC_API_KEY as required — that discrepancy should be resolved before trusting automated runs.
ℹ 指令范围
SKILL.md explicitly instructs the agent to write config and generated content to local paths (.factory/config/aka-wireframe/, generated-content/) and to run the five-step workflow including an optional auto-deploy to WordPress. All file reads/writes and the optional WP REST API deployment are within the claimed scope. This does grant the skill access to local project files and, if you provide them, WordPress credentials — so inspect outputs and use dry-run/staging first. There are no instructions to read unrelated system files or exfiltrate data to unknown endpoints.
✓ 安装机制
This is an instruction-only skill with no install spec and no downloads. No packages or external installers are pulled — lowest-risk install posture.
ℹ 凭证需求
The only required credential is ANTHROPIC_API_KEY (used for the claimed model). WordPress credentials (URL, username, application password) are optional and clearly documented as only needed for the deploy step. This is proportionate. However, the registry metadata contradicts SKILL.md (metadata said no required env vars). Also, WP_PASS is sensitive — the skill suggests using an Application Password and revoking it after use (good guidance).
ℹ 持久化与权限
The skill does not request always:true and does not modify other skills. It writes project state and progress to local files (progress-tracker.json, .factory/*), which is consistent with orchestrator behavior. One consideration: autonomous invocation is enabled by default (disable-model-invocation: false). Combined with provided WP credentials and the skill's 'auto' mode, the agent could autonomously deploy to your site if invoked — use dry-run/staging or restrict autonomous execution if you want to avoid automatic deployments.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.12026/3/29
Revert to v1.0.5 credentials schema (was Benign) — separate required/optional credential entries
● 无害
安装命令
点击复制官方npx clawhub@latest install aka-seo-wireframe
镜像加速npx clawhub@latest install aka-seo-wireframe --registry https://cn.longxiaskill.com