by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: discover a local Clash controller, test proxies, switch selector groups, and optionally install a macOS LaunchAgent to run periodically. Before installing, review the included scripts (switch_fastest.py and install_launch_agent.sh). Key points to consider:
- The script will read local Clash config files (~/.config/clash/config.yaml and Clash Verge's config path) and will read CLASH_API_UNIX_SOCKET, CLASH_API_URL, and CLASH_API_SECRET environment variables i...详细分析 ▾
✓ 用途与能力
Name/description match the implementation: the scripts discover a local Mihomo/Clash controller (via explicit args, CLASH_API_* env vars, or local config files), call the controller API, run latency tests, and switch selector groups. No unrelated cloud credentials or unrelated binaries are requested.
ℹ 指令范围
SKILL.md and the scripts instruct the agent to read local Clash config files (~/.config/clash/config.yaml and ~/Library/Application Support/...), consult environment variables (CLASH_API_UNIX_SOCKET, CLASH_API_URL, CLASH_API_SECRET), call the controller via curl (HTTP or unix socket), and optionally launch the Clash app. These actions are within the stated purpose but are broad (they examine local config and may modify controller state by switching selectors).
✓ 安装机制
There is no external download; install is a local zsh script that writes a user LaunchAgent plist under ~/Library/LaunchAgents and uses launchctl. This is a standard macOS user-level installation method and the script does not pull code from remote URLs.
⚠ 凭证需求
The skill does not declare required env vars but will read CLASH_API_UNIX_SOCKET, CLASH_API_URL, and CLASH_API_SECRET if present and will use any 'secret' from local configs as an Authorization header to the controller. While these env/config accesses are necessary for discovering and authenticating to a Clash controller, users should be aware the script will read local config files and environment variables and may send the secret value to the controller API.
ℹ 持久化与权限
The provided installer creates a user LaunchAgent that will run the bundled Python script at the chosen interval and write logs to ~/Library/Logs. The skill does not set always:true; installation is explicit via the install script, but installing grants the script periodic execution under the user account.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/25
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install clash-verge-auto-switch
镜像加速npx clawhub@latest install clash-verge-auto-switch --registry https://cn.longxiaskill.com