by 安全扫描
OpenClaw
安全
high confidenceThe skill is an instruction-only ChatGPT Apps builder and its requirements and instructions are consistent with that purpose; it does not request unexplained credentials or install arbitrary code but will guide you to produce and run code locally that requires external deployment/auth credentials.
评估建议
This skill is an instructions-only builder for ChatGPT Apps and is internally consistent. Before using it: 1) Be prepared to provide deployment and auth credentials yourself (Auth0, Supabase, Render, ChatGPT connector) — the skill won't silently grab them. 2) When the agent generates files (setup.sh, START.sh, Dockerfile, server code), review those scripts and the produced code before executing them locally or deploying to production. 3) Use least-privilege/test credentials for deployment and au...详细分析 ▾
✓ 用途与能力
The name/description (ChatGPT Apps builder) matches the SKILL.md: it provides step-by-step workflows for designing, implementing, testing, and deploying apps. There are no declared env vars or binary requirements that are unrelated to building/deploying apps.
ℹ 指令范围
Instructions stay within app-building scope (generate project files, tool handlers, widgets, tests, Dockerfile, deploy to Render). They tell the agent to generate and run setup.sh/START.sh and to configure connectors/auth. They do not instruct reading arbitrary system files or exfiltrating data, but they do assume the agent/user will provide external service credentials during auth/deploy steps (Auth0/Supabase/Render/ChatGPT connector).
✓ 安装机制
This is an instruction-only skill with no install spec and no code files — minimal install risk (nothing will be written or executed by the platform as part of installing the skill).
ℹ 凭证需求
The skill declares no required environment variables (none requested). However, the workflows explicitly reference third-party services (Auth0, Supabase, Render, ChatGPT connector) that will require credentials to configure and deploy; those are not requested by the skill itself but will be needed to complete some steps. Expect to supply service API keys/IDs during use — the skill does not automatically collect them.
✓ 持久化与权限
always:false and user-invocable:true (normal). The skill does not request permanent presence or modify other skills; it only instructs the agent to generate project files in the user's workspace if the user asks it to.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/1/27
No changes detected in this release. - Version updated without any file or documentation changes. - No modifications to functionality or interface.
● 可疑
安装命令
点击复制官方npx clawhub@latest install chatgpt-apps
镜像加速npx clawhub@latest install chatgpt-apps --registry https://cn.longxiaskill.com