by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements and instructions are consistent with an integration that uses the Membrane CLI as a proxy to access Alibaba Cloud; nothing requested is out of scope, though installing an npm CLI and routing API traffic through a third party are notable operational considerations.
评估建议
This skill is internally consistent: it uses Membrane as an intermediary to talk to Alibaba Cloud. Before installing/using it, verify the Membrane service and CLI: review the @membranehq/cli npm package source, consider using npx (avoids a global install), and read Membrane's privacy/security docs to confirm how API requests and credentials are handled. Use least-privilege Alibaba Cloud credentials when connecting (create a dedicated role/account for the integration), and avoid pasting secrets i...详细分析 ▾
✓ 用途与能力
The skill claims to integrate with Alibaba Cloud and the SKILL.md instructs using the Membrane CLI to create connections, run actions, and proxy API requests. Requiring a connector and a Membrane account is coherent with the described purpose.
ℹ 指令范围
Instructions are limited to installing and using the Membrane CLI, performing login flows, listing/creating connections, running actions, and optionally proxying raw API requests. A notable operational detail: proxying requests via Membrane means API calls and data will transit (and may be stored/processed) by the Membrane service — this is expected for a proxy-based integration but worth confirming against your data-handling requirements.
ℹ 安装机制
There is no baked install spec in the package, but the docs instruct installing @membranehq/cli via npm (global) or using npx. Installing npm packages (especially global installs) runs third-party code on the host and requires trust in the package and publisher; this is proportionate to the skill's stated function but carries normal supply-chain/install risks.
✓ 凭证需求
The skill declares no required environment variables, no local config paths, and no primary credential. All credential management is delegated to Membrane (the documented login flow). The requested scope of access (an account/connector) aligns with the integration purpose.
✓ 持久化与权限
The skill is instruction-only, has no install-time modifications declared, and does not request 'always: true' or any elevated persistence. Agent autonomous invocation is allowed (platform default) but not combined with other red flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/6
Auto sync from membranedev/application-skills
● 无害
安装命令
点击复制官方npx clawhub@latest install alibaba-cloud
镜像加速npx clawhub@latest install alibaba-cloud --registry https://cn.longxiaskill.com