by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- The skill DOES require a DataHub API key, even though the registry metadata omitted it. Expect to provide DATAHUB_API_KEY or create ~/.datahub/config.json or a project config file.
- The included scripts will read config files in your home directory and current working directory. Inspect those files and the scripts locally before running to ensure no unexpected file accesses.
- The scripts send your API key in the request body, in an X-API-Key header, and (f...详细分析 ▾
⚠ 用途与能力
SKILL.md and the included scripts clearly implement a DataHub client that needs a DATAHUB_API_KEY and reads user/project config files (e.g., ~/.datahub/config.json, .datahub.json, datahub.config.json). The registry metadata declares no required env vars or config paths — this mismatch is an incoherence that should be resolved before trusting the skill.
ℹ 指令范围
Runtime instructions are limited to submitting queries and polling results (node scripts). The scripts do read config files from the user's home and current working directory to obtain the API key; they otherwise only perform network calls to the DataHub host. There is no instruction to read arbitrary user files or exfiltrate unrelated secrets, but the skill will access local config files that may contain credentials.
✓ 安装机制
No install spec — this is instruction-only with included Node scripts. Nothing is downloaded at install time. This has lower install risk; the included scripts are static and their behavior can be reviewed locally.
⚠ 凭证需求
Although the functionality legitimately requires a DataHub API key, the registry did not declare any required environment variables or primary credential. The scripts accept the key via DATAHUB_API_KEY or config files. The implementation also places the key in request body, header, and (for polling) in URL query parameters — increasing risk of accidental leakage via logs, referers, or intermediary proxies. The number and placement of secrets handling should be disclosed in metadata.
✓ 持久化与权限
The skill does not request persistent, always-on privileges (always: false). It does not modify other skills or system-wide settings. It only reads its own expected config files for the API key.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/4/11
NULL
● Pending
安装命令
点击复制官方npx clawhub@latest install datahub
镜像加速npx clawhub@latest install datahub --registry https://cn.longxiaskill.com