by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's description promises running a local 20MB miner/node, but the runtime instructions only list plugin RPC operations and omit any install steps, required binaries, or details about how wallet keys and node processes are managed — the pieces don't fully align.
评估建议
This skill is ambiguous: it promises a local 'miner' and quick setup but provides no install instructions, and it offers token-transfer operations without explaining where wallet keys live or how transactions are signed. Before installing/using: (1) verify the skill's source and publisher (there's no homepage and the owner ID is opaque); (2) ask the publisher how the node is started (is an 'openclaw' CLI required?) and whether any binaries will be downloaded or run; (3) confirm how private keys ...详细分析 ▾
⚠ 用途与能力
The name/description claim you can 'run a 20MB blockchain node' and 'become a miner' with a 4-minute setup, but there is no install spec, no declared required binaries, and no instructions for downloading, installing, or running node software. That claim is not supported by the provided instructions.
⚠ 指令范围
SKILL.md exposes plugin operations (status, balance, transfer, faucet, register, service operations) which is consistent with a remote plugin, but it also suggests running a local command ('openclaw clawnetwork start') if the node is offline while not declaring that 'openclaw' is required or how it is provided. The doc lacks detail about where private keys live, how transfers are signed, and what running a 'miner' entails.
ℹ 安装机制
No install spec and no code files — lowest-risk format for distribution. However, the skill's marketing of an on-agent miner/setup implies software would be installed or run; that contradiction is notable even though no installer is present.
⚠ 凭证需求
The skill declares no required env vars or credentials, yet it supports transferring tokens and registering agent identity. It is unclear where signing keys/wallets are stored or whether the platform will prompt for credentials. Lack of declared primary credential or explanation of key management is disproportionate for a coin-transfer capability.
✓ 持久化与权限
always is false and there is no evident attempt to persist or modify other skills or system-wide settings. Autonomous invocation is allowed (default), which is normal; nothing indicates excessive privilege here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/31
Updated description: Earn CLAW by running a 20MB blockchain node. Your OpenClaw agent becomes a miner — 4 min setup, zero cost.
● 无害
安装命令
点击复制官方npx clawhub@latest install clawnetwork-node
镜像加速npx clawhub@latest install clawnetwork-node --registry https://cn.longxiaskill.com