by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This guide is generally coherent for setting up IM channels, but review a few things before proceeding: 1) Confirm you have the openclaw CLI installed and understand where it is installed (the SKILL.md assumes /root and nvm); run commands as a non-root user when possible. 2) The instructions ask you to add bot tokens/app secrets into OpenClaw config — treat those as sensitive: store them in a secure location, restrict file permissions, and avoid pasting secrets into chats. 3) The doc references ...详细分析 ▾
✓ 用途与能力
The skill's name/description (channels setup) matches the instructions: it shows how to enable/configure Telegram, Discord, Slack, Feishu, and Dingtalk via the openclaw CLI or by editing openclaw.json. Requiring channel tokens and app secrets in configuration is expected for this purpose.
ℹ 指令范围
Most instructions stay on-task (setting config keys and enabling channels). However the SKILL.md references absolute root paths (/root/.nvm/nvm.sh, /root/.openclaw/..., /root/.local/share/pnpm/...) and suggests running ls against those paths. Those references assume a specific install location and root user context and could cause confusion or unnecessary access attempts; the file-edit and restart steps manipulate local config and services as expected for channel setup.
✓ 安装机制
There is no install specification and no code files — this is instruction-only, so nothing will be downloaded or written by the skill itself. This is the lowest-risk install model.
ℹ 凭证需求
The skill does not declare required environment variables but instructs you to provide sensitive tokens/secrets (botToken, appSecret, clientSecret, gateway tokens/passwords) in the OpenClaw config files or via the openclaw CLI. That is proportionate to the task, but you should be aware these are sensitive credentials and the SKILL.md assumes you will place them in local config (not environment variables).
✓ 持久化与权限
always is false and the skill is user-invocable only. The skill does instruct restarting the gateway (openclaw gateway restart), which changes system state, but it does not request persistent privileges or attempt to modify other skills' configurations.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/25
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install channels-setup
镜像加速npx clawhub@latest install channels-setup --registry https://cn.longxiaskill.com