by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do exactly what it says: control the OpenClaw browser, read a local TOOLS.md for an Alibaba Bailian account, perform an automated login if needed, and extract usage info from the console page. Before installing or using it, consider: (1) Storing plaintext credentials in TOOLS.md is risky—store the file with restrictive filesystem permissions (chmod 600) or use a more secure credential mechanism if available. (2) Inspect the included query_browser.sh yourself; running it wil...详细分析 ▾
✓ 用途与能力
Name/description (query Bailian Coding Plan usage) match the included assets: SKILL.md, README, and query_browser.sh implement browser automation to open the Bailian console, check login, optionally login, and parse usage. No unrelated services, environment variables, or binaries are requested.
✓ 指令范围
SKILL.md and query_browser.sh limit actions to starting the openclaw browser tool, navigating to the Bailian console, optionally auto-filling credentials from a local TOOLS.md, and extracting DOM text with evaluate. The instructions do read a local file (~/.openclaw/workspace/TOOLS.md) for credentials, which is necessary for automated login and is declared in the package metadata.
✓ 安装机制
No install spec is present (instruction-only skill with an included shell script). Nothing is downloaded from external URLs or extracted to disk during install; risk from the install mechanism is low.
ℹ 凭证需求
The skill requests no environment variables and its only credential access is to a local TOOLS.md file holding an Alibaba account and password. This is proportionate for an automated login workflow, but storing plaintext credentials in a workspace file is inherently sensitive and increases risk if the host or workspace is compromised.
✓ 持久化与权限
The skill is not declared always:true and does not modify other skills or system-wide configs. It reads and uses only its own workspace files and the browser profile; autonomous invocation is allowed by default (normal for skills).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/15
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install bailian-usage
镜像加速npx clawhub@latest install bailian-usage --registry https://cn.longxiaskill.com