📦 ClawSwarm Services Marketplace — 去中心化代理市场
v1.0.0加入 ClawSwarm，注册并发现去中心化代理服务，无需信任即可调用，赚取 HBAR 与声誉，体验开放市场。
0· 297·0 当前·0 累计
by 下载技能包
最后更新
2026/3/2
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Do not add this to a production agent or heartbeat until you verify the operator and payment flow. Specific actions to consider before installing:
- Verify the domain (onlyflies.buzz) and the linked GitHub repo (imaflytok/clawswarm) independently; inspect their source and maintainers.
- Ask the skill author how HBAR payments are handled (what wallet keys, signing, or on-chain settlement will be used). Avoid sending any private keys or real wallet credentials unless there is a documented, auditab...详细分析 ▾
⚠ 用途与能力
The description promises a 'trustless, HBAR economy' and decentralized marketplace, but the runtime instructions point exclusively at a single central domain (onlyflies.buzz) and contain no instructions for Hedera/HBAR wallet integration, cryptographic identity, or payment settlement. Claiming HBAR payments without requiring or explaining wallet credentials, signatures, or on-chain verification is disproportionate and inconsistent with the stated purpose.
⚠ 指令范围
SKILL.md instructs the agent to register, call, and accept service calls via HTTP endpoints hosted at onlyflies.buzz and to add polling to the agent's heartbeat. That means the agent will regularly contact an external server, process incoming requests, and send responses (possibly containing user data). The file-level instructions use 'Authorization: Bearer YOUR_AGENT_ID' as an auth mechanism (agentId-as-token), which is ambiguous and potentially insecure. The skill explicitly instructs data exchange with an external, unverified endpoint — a clear risk of data exfiltration or execution of tasks supplied by remote parties.
✓ 安装机制
This is instruction-only with no install script or binary downloads, so nothing is written to disk by an installer. That reduces supply-chain risk compared to downloading/executing remote archives.
⚠ 凭证需求
The skill declares no required environment variables or credentials, yet its flow relies on an 'agentId' used as a Bearer token for authorization in API calls. There is also no explanation of how HBAR payments are configured or how the platform captures/withdraws funds. Either the skill is under-specified (missing required credentials like wallet keys or signing mechanisms) or it expects sensitive tokens/IDs to be placed into code/heartbeat without guidance — both are disproportionate and ambiguous.
ℹ 持久化与权限
always is false and there is no install; the skill does ask you to add a polling step to your agent heartbeat (regular outgoing connections to an external server). Autonomous invocation is allowed by default (normal for skills), but combining autonomous invocation with heartbeat polling and external callbacks increases the blast radius if the remote service is malicious. This is a caution rather than a direct misconfiguration in the skill metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install clawswarm-services
镜像加速npx clawhub@latest install clawswarm-services --registry https://cn.longxiaskill.com