by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill legitimately needs only an APIClaw API key and will send requests to api.apiclaw.io. Before installing, review and be comfortable with: (1) granting the APICLAW_API_KEY (consider using a limited/ephemeral key), (2) the bundled script files (scripts/apiclaw.py) since the agent will execute them locally, and (3) the fact the script may create/read a config.json in the skill directory to store the key. Do not provide other credentials. If you need stronger assurance, verify the APICLAW p...详细分析 ▾
✓ 用途与能力
The name and description claim review analysis via the APIClaw service and the skill only requires an APIClaw API key and invokes APIClaw endpoints. The included script and SKILL.md enumerate and use the same 11 APIClaw endpoints described in the README and references, which is proportionate to the stated capability.
✓ 指令范围
Runtime instructions direct the agent to call the apiclaw API endpoints (via the provided scripts/apiclaw.py) and to only report API-returned insights. The script reads APICLAW_API_KEY from the environment or an optional local config.json in the skill directory; it does not attempt to read unrelated system paths or other environment variables. Network calls are to the declared base URL (api.apiclaw.io), which matches the skill's purpose.
✓ 安装机制
No install spec is present (instruction-only with a bundled script). That minimizes install-time risk; the included Python script will be executed by the agent when invoked but is not installed from a remote, untrusted URL.
✓ 凭证需求
Only APICLAW_API_KEY is declared/required and is necessary for authenticating to the APIClaw service. The script also optionally reads config.json inside the skill directory to obtain the same key—this is consistent with typical CLI behavior and is justified by the skill's functionality.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide agent settings. It may read/write a config.json under its own skill directory (to store the API key) which is a normal local preference behavior.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/4/9
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install amazon-review-intelligence-extractor
镜像加速npx clawhub@latest install amazon-review-intelligence-extractor --registry https://cn.longxiaskill.com