📦 COCOS CLI Game Development — Cocos游戏开发
v0.0.3一键创建、构建并修改 Cocos 2D/3D 游戏项目，支持代码与资源管理，帮助开发者快速启动或迭代游戏。
0· 153·0 当前·0 累计
by @liuyihunter下载技能包
最后更新
2026/4/7
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill mostly does what it says (create/build Cocos projects) but has two red flags you should consider before enabling it: 1) The skill's metadata does not list the Cocos CLI as a required binary even though the instructions rely on it—confirm your environment has the CLI installed. 2) The instructions tell the agent to automatically register/connect the local MCP server with OpenClaw and enumerate its tools without asking the user. That grants the agent autonomous network/registration beha...详细分析 ▾
⚠ 用途与能力
The SKILL.md clearly requires the Cocos CLI (runs `cocos --help`, `cocos create`, `cocos start-mcp-server`), but the registry metadata lists no required binaries—this mismatch is inconsistent. Otherwise the requested operations (create/build via Cocos CLI and a project-local MCP server) are coherent with the skill's stated purpose.
⚠ 指令范围
Most runtime steps stay within project creation, starting a local MCP server, and using MCP-provided tools. However, the instructions explicitly require automatically connecting/registering the MCP server with OpenClaw and immediately enumerating exposed tools 'without waiting for user approval' — that is scope-creep and grants the agent broad, autonomous probing and potential registration behavior not justified by a simple CLI helper. It also mandates running a long-running background server process (background: true), which has operational and security implications (open ports, long-lived processes).
✓ 安装机制
This is an instruction-only skill with no install spec or downloaded artifacts, which is a low-risk install footprint. Nothing will be written to disk by an installer step beyond what the Cocos CLI and user commands do.
⚠ 凭证需求
The skill declares no required environment variables or credentials, yet it instructs automated registration of an MCP server with OpenClaw (implying integration with agent tooling and possibly network endpoints). Also metadata omits the obvious dependency on the Cocos CLI binary. The absence of declared credentials or network access details while requiring automatic tool discovery is disproportionate and unclear.
⚠ 持久化与权限
always: false (good) and agent autonomous invocation is normal, but the SKILL.md's direction to auto-connect/register the MCP server and immediately probe its tools 'without waiting for user approval' effectively elevates the skill's runtime privileges and autonomy. This behavior should require explicit user consent before performing network registration or discovery.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.0.32026/4/3
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install cocos-cli-game-dev
镜像加速npx clawhub@latest install cocos-cli-game-dev --registry https://cn.longxiaskill.com