📦 Desktop Sandbox — 安全沙盒
v1.1.1在本地桌面环境中为 OpenClaw 提供接近原生系统的运行空间，完整功能与隔离安全兼得，无需担心破坏主机。
2· 1.2k·3 当前·3 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill will download a platform installer from the GitHub releases of AtlasCore-tech/desktop-sandbox-openclaw and execute it on your machine. That behavior matches its stated purpose but has real risk because installers run with system impact. Before using it: (1) verify the upstream GitHub repo and its maintainer are trustworthy, (2) inspect the release assets and checksums on the repo yourself (or ask for signed releases), (3) run the installer in a disposable/test environment first, (4) a...详细分析 ▾
✓ 用途与能力
The name and description claim to install a desktop sandbox. The code and SKILL.md implement a downloader/installer that fetches GitHub releases from the specified repo and runs the .pkg on macOS or .exe on Windows. Requiring node is appropriate for the provided Node script.
ℹ 指令范围
Instructions are narrow and explicit: run node scripts/run_installer.js (optionally with --version). The installer script downloads release assets from GitHub and executes them. This is in-scope for an installer, but the runtime will download arbitrary binaries from the repo's releases and execute them (including installing into system locations), which is a high-impact action that users should consciously approve.
ℹ 安装机制
There is no packaged install spec; the skill is instruction + embedded Node script. The script uses the GitHub API to find release assets and downloads them directly (via HTTPS) before running installers. Using GitHub releases is a reasonable source, but downloading and executing release assets is moderate risk compared with an instruction-only skill because it writes and executes binaries on the host.
✓ 凭证需求
The skill only requires the node binary and does not request credentials, environment variables, or config paths. The script does not appear to read unrelated environment variables or sensitive files in the provided portion of the code.
ℹ 持久化与权限
The skill does not request permanent presence (always:false) and does not modify other skills. However, it attempts to run OS installers that may write to system directories (e.g., Program Files / root), which can trigger elevation prompts or require administrative privileges. That is expected for an installer but increases the potential impact if the upstream installer is untrusted.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.12026/2/11
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install desktop-sandbox
镜像加速npx clawhub@latest install desktop-sandbox --registry https://cn.longxiaskill.com