by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions match its stated DataWorks purpose, but the registry metadata omits required credentials/env and the runtime instructions ask users to run remote install scripts and enable automatic plugin installs — discrepancies that warrant caution.
评估建议
What to consider before installing/using this skill:
- The SKILL.md requires Alibaba Cloud credentials (AK/SK, STS, or other modes) and specific ALIBABA_CLOUD_* env vars, but the registry metadata does not declare these — assume you must configure credentials outside the agent before use.
- The instructions ask you to run remote installation scripts (curl|bash) and enable `--auto-plugin-install`/`ai-mode`. Those steps can cause the CLI to fetch and execute code from the network. Only run them fr...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes a DataWorks operations assistant and all CLI commands and RAM permissions are consistent with that purpose. However, the registry metadata declares no required credentials/env while the instructions clearly require Alibaba Cloud credentials and specific ALIBABA_CLOUD_* timeouts.
⚠ 指令范围
Runtime instructions ask the operator to run remote install commands (curl|bash) and to enable `--auto-plugin-install` / `ai-mode`. They also mandate setting ALIBABA_CLOUD_CONNECT_TIMEOUT/READ_TIMEOUT and contain strict rules about not echoing AK/SK. Enabling auto plugin install increases the chance of remote code being fetched at runtime; the skill's instructions do not fully explain the provenance or vetting of those plugins.
⚠ 安装机制
Although there is no registry install spec, the SKILL.md instructs users to run `curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash` and to download aliyun CLI binaries from aliyuncli.alicdn.com. The URLs point to Alibaba's CDN (expected for aliyun CLI), but piping remote scripts to a shell and enabling auto-plugin-install are higher-risk practices and should be run only from a trusted environment after inspection.
⚠ 凭证需求
The skill requires Alibaba Cloud credentials and specific ALIBABA_CLOUD_* env vars at runtime, but the registry metadata lists no required env vars or a primary credential. This mismatch between declared metadata and actual instructions is a red flag. The RAM permissions requested are limited to DataWorks read/list/log and are proportionate to the described functionality.
✓ 持久化与权限
The skill is instruction-only, has no install-time persistence in the registry, and `always` is false. It does not request system-wide modifications or permanent presence beyond recommending CLI configuration and plugin behavior.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.0.22026/4/13
alibabacloud-dataworks-data-ops v0.0.2 - Increased minimum required version of Aliyun CLI to 3.3.3 and updated installation instructions. - Added mandatory steps for enabling and disabling Aliyun CLI AI-mode and setting a custom User-Agent before and after execution. - Updated command usage examples to use the correct custom User-Agent string. - Clarified environment setup steps, including plugin update requirements. - Documentation improvements for installation, environment variables, and workflow steps.
● Pending
安装命令
点击复制官方npx clawhub@latest install alibabacloud-dataworks-data-ops
镜像加速npx clawhub@latest install alibabacloud-dataworks-data-ops --registry https://cn.longxiaskill.com