by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears to do what it claims (register and maintain Axon agents), but take these precautions before installing:
- Private key security: the scripts require a local EVM private key file. Keep it on a dedicated, access-restricted host (chmod 600), and avoid using this key for other purposes. Consider using a hardware signer or isolated VM if feasible.
- Verify source before building: the instructions clone and build a Go daemon from the Axon GitHub repo. Confirm the repo URL and review...详细分析 ▾
ℹ 用途与能力
The files and SKILL.md behavior align with the stated purpose: registering an EVM address as an Axon Agent, checking on-chain status, running a heartbeat daemon, and a watchdog cron. The skill legitimately requires a local EVM private key file and chain RPC access. Minor inconsistency: the registry metadata claims no required binaries/config paths/env vars, but the instructions require Python 3.8+, Go 1.21+, git/ssh/scp/nohup and a private key file path (e.g. /opt/axon/private_key.txt). This metadata omission reduces transparency but does not contradict the stated purpose.
✓ 指令范围
Runtime instructions focus on Axon-specific tasks: checking status, calling register() by signing a transaction with a local private key file, building and running the official agent-daemon, and installing a watchdog cron. The scripts only read the provided private key file and use the Axon RPC endpoint; they do not instruct reading unrelated system files or exfiltrating data to unknown external endpoints.
ℹ 安装机制
There is no packaged install spec; the SKILL.md instructs users to clone and build the official Axon repo (https://github.com/axon-chain/axon) and run the built Go daemon. Building and running a network-fetched Go binary is expected for a daemon, but it is a supply-chain risk — you execute code fetched from a remote repo. The repo URLs referenced appear to be the official project, which reduces concern but users should still verify the source and optionally audit the daemon code before building/executing.
ℹ 凭证需求
The only sensitive credential required is an EVM private key (kept in a local file). That is proportionate to registering/signing transactions on-chain. However, the skill metadata did not declare required config paths or a primary credential; the SKILL.md does rely on a private-key file path and local filesystem permissions. The omission in metadata reduces clarity about secrets handling and should be noted by users.
ℹ 持久化与权限
The skill instructs building and running a long-lived agent-daemon and installing a cron-based watchdog: this grants persistent presence on the host and requires access to the private key file. That level of persistence is expected for the described functionality but increases the security impact if the built binary or private key is compromised. The skill does not request 'always: true' or modify other skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.42026/3/14
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install axon-agent
镜像加速npx clawhub@latest install axon-agent --registry https://cn.longxiaskill.com