by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Before installing: (1) Ask the publisher to update the registry metadata to explicitly declare required env vars (ALICLOUD_ACCESS_KEY_ID, ALICLOUD_ACCESS_KEY_SECRET, ALICLOUD_REGION_ID). Do not set those credentials globally until you verify the publisher. (2) Use least-privilege credentials (restrict to IMS and OSS actions and specific resources) or temporary STS tokens rather than long-lived root keys. (3) Confirm there is a trustworthy source/homepage or repository for the skill and request p...详细分析 ▾
ℹ 用途与能力
The stated purpose (manage Alibaba Cloud IMS video translation jobs) matches the SKILL.md instructions (SubmitVideoTranslationJob, GetSmartHandleJob, ListSmartJobs/DeleteSmartJob). Asking for ALICLOUD_ACCESS_KEY_ID / ALICLOUD_ACCESS_KEY_SECRET / ALICLOUD_REGION_ID in the prerequisites is appropriate for this purpose. However, the registry metadata lists no required env vars or primary credential — that mismatch is unexpected and reduces transparency.
⚠ 指令范围
SKILL.md instructs the agent to call Alibaba Cloud OpenAPI endpoints and to use OSS input/output URIs. It references specific environment variables (AK/SK/region) and asks the agent to save API responses and evidence under an output directory. There are no instructions to read unrelated local files, but the instructions do not appear in the declared metadata, giving the agent discretion to use credentials not declared in the registry; this is a scope/visibility concern.
✓ 安装机制
This is an instruction-only skill with no install spec and no included code files, so it does not write or execute new code on disk. That is low-risk from an install perspective.
⚠ 凭证需求
The SKILL.md requires highly sensitive credentials (ALICLOUD_ACCESS_KEY_ID and ALICLOUD_ACCESS_KEY_SECRET) which are proportionate to the claimed cloud operations, but the skill's declared requirements do not list them. The lack of declared env vars reduces transparency about what secrets the skill will use and increases risk if users supply broad-scoped credentials.
✓ 持久化与权限
The skill does not request always:true, does not install persistent components, and does not modify other skills or system-wide settings. Autonomous invocation is allowed by default (platform normal) but not elevated by the skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/2/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install alicloud-media-video-translation
镜像加速npx clawhub@latest install alicloud-media-video-translation --registry https://cn.longxiaskill.com