by 下载技能包
最后更新
2026/4/13
安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly matches its described goal of managing .openclaw/MISSION.md and SNAPSHOT.md, but documentation, runtime instructions, and included code disagree in several places (missing referenced scripts, mismatched paths/CLI commands, and implicit use of a home-registry file), so the package is inconsistent and worth a closer look before use.
评估建议
This package is not clearly fraudulent, but it contains inconsistencies you should resolve before trusting it. Steps to take before installing/using: 1) Inspect the included files (scripts/*.py and templates) to confirm behavior — they run locally and only read/write .openclaw files and ~/.openclaw workspace. 2) Open ~/.openclaw/workspace/data/appm_registry.json (if it exists) and inspect its contents and referenced project paths — it may point to arbitrary directories. 3) Note missing pieces cl...详细分析 ▾
ℹ 用途与能力
The declared purpose (project snapshot/mission management) aligns with the included scripts (init.py, appm_recall.py, appm_update_weights.py) and templates. However README/SKILL.md mention additional tooling and features (appm_tracker.py, atlas_bootstrap.py, appm_init_dual.py, an 'openclaw appm' CLI, and a background tracker) that are not present in the bundle — a documentation vs. implementation mismatch.
⚠ 指令范围
SKILL.md instructs the agent to 'must force read' .openclaw/MISSION.md and SNAPSHOT.md and to update snapshots on milestones — which is within expected scope. But instructions also claim background auto-execution and dynamic tracking (automatic keyword tracking, boot-time anchoring) and reference data/appm_registry.json without clarifying the registry path; the actual scripts use ~/.openclaw/workspace/data/appm_registry.json. The SKILL.md/README promise features not implemented by the included scripts, creating ambiguity about what the agent will actually execute.
ℹ 安装机制
No install spec (instruction-only) — lowest install risk. But the bundle includes runnable Python scripts; without an install step these files will simply be present and can be executed by the agent or user. There are no network downloads or obfuscated installers in the package.
ℹ 凭证需求
The skill requests no environment variables or external credentials. The scripts read and write files under the user's home (~/.openclaw/workspace/data/appm_registry.json and LOGBOOK.md) and project .openclaw directories — this is proportionate to the stated purpose, but those home-registry files could contain paths or metadata referencing arbitrary project directories, so they should be reviewed before use.
✓ 持久化与权限
The skill does not request 'always:true' and does not modify other skills or system-wide agent settings. It does write to its own data paths (home workspace and project .openclaw), which is expected for persistence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.2.02026/4/11
Fix Telegram blocking issue by optimizing proactive reporting and adding Reboot Reflection feature.
● 无害
安装命令
点击复制官方npx clawhub@latest install appm
镜像加速npx clawhub@latest install appm --registry https://cn.longxiaskill.com