by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
Things to check before installing: (1) Verify the endpoint https://api.clawvival.app and the maintainers — the skill will register an agent and write credentials to ~/.config/clawvival/credentials.json and then use those credentials for repeated HTTP calls. Only install if you trust that server. (2) Ask why the registry metadata lists no required binaries/env while the SKILL.md requires curl, jq, and a 'summarize' binary via a third-party brew tap; avoid installing untrusted brew taps. (3) Note ...详细分析 ▾
ℹ 用途与能力
The skill claims to be an agent-facing survival manual and its core HTTP observe/action/status flow matches that purpose. However, the registry metadata lists no required binaries or env vars while the SKILL.md runtime prerequisites explicitly require curl, jq, and a credential file at ~/.config/clawvival/credentials.json. The SKILL.md frontmatter also advertises a 'summarize' binary and a brew install (steipete/tap/summarize) even though the registry shows no install spec — this mismatch is unexpected.
⚠ 指令范围
Runtime instructions direct the agent to create ~/.config/clawvival/credentials.json via an HTTP POST to https://api.clawvival.app, to read agent_id and agent_key from that file and export them as env vars, and to perform periodic autonomous heartbeats. Those file and network operations are necessary for an autonomous game agent, but they access local filesystem and persistent credentials that were not declared in the registry metadata. The skill also instructs to include agent_id in a status_page URL (potential identifier leakage).
ℹ 安装机制
The registry shows no install spec (instruction-only), but the SKILL.md frontmatter contains an install suggestion: a brew formula steipete/tap/summarize and dependency on a 'summarize' binary. This embedded install instruction is inconsistent with the declared registry install info and references a third-party tap (not an official system package), which should be validated before allowing installation.
⚠ 凭证需求
The skill declares no required environment variables or primary credential in registry metadata, yet the instructions create and export CV_AGENT_ID and CV_AGENT_KEY from a local credential file and require those be sent to the remote API. Requesting and persisting agent credentials on disk (and exporting them into environment) is proportionate to a networked agent but should have been declared up-front. The skill's guidance to never reveal agent_key is good, but the instructions also encourage embedding agent_id in a public status_page URL which may leak identifying information.
ℹ 持久化与权限
The skill does not set always:true and does not request modifications to other skills. However, it explicitly encourages periodic autonomous heartbeats (recommended every 30 minutes) and a persistent credential file that enables repeated autonomous calls. Autonomous invocation combined with undisclosed credential usage increases blast radius; this is expected for an autonomous game agent but worth confirming you trust the remote service.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.6.32026/2/17
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install clawvival-survival
镜像加速npx clawhub@latest install clawvival-survival --registry https://cn.longxiaskill.com