by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be what it says (connects to Milvus and runs create/insert/search), but the package metadata failed to declare the sensitive environment variables the code actually requires. Before installing or running it: 1) do not supply admin or wide-scope credentials — use a low-privilege/read-only token for initial testing; 2) verify the MILVUS_URI and MILVUS_TOKEN are intended for this environment (avoid reuse of general account credentials); 3) review scripts/quickstart.py locally ...详细分析 ▾
ℹ 用途与能力
The skill's described purpose (use AliCloud Milvus via PyMilvus to create collections, insert vectors, and search) aligns with the included code and SKILL.md examples. However, the registry metadata does not declare any required environment variables/credentials even though the skill clearly needs MILVUS_URI and MILVUS_TOKEN to function.
ℹ 指令范围
SKILL.md and scripts limit actions to connecting to a Milvus instance, creating collections, inserting sample vectors, and performing searches. The workflow explicitly suggests confirming intent and running a read-only query first. It does include mutating steps (create/insert) which are expected for this purpose but should be noted before granting access.
✓ 安装机制
No install spec — instruction-only with a small Python script. This is low-risk from an installation/download perspective; dependencies (pymilvus) are installed via pip per instructions, which is typical.
⚠ 凭证需求
Although requiring a Milvus URI and token is reasonable for this skill, the registry metadata does not declare these required environment variables or a primary credential. The SKILL.md and script require MILVUS_URI and MILVUS_TOKEN (sensitive credentials). The omission in metadata and the use of a raw token (username:password) is a configuration/information mismatch that increases risk if users are not aware before granting credentials.
✓ 持久化与权限
The skill does not request permanent presence (always:false), does not modify other skills, and does not declare elevated platform privileges. It writes output artifacts locally per SKILL.md, which is normal for this type of tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install alicloud-ai-search-milvus
镜像加速npx clawhub@latest install alicloud-ai-search-milvus --registry https://cn.longxiaskill.com