by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to implement a legitimate DigitalOcean CLI, but metadata and documentation disagree about credentials and packaging — the SKILL.md and script expect an API token at ~/.config/digitalocean/token while the registry metadata lists no required credentials or config paths. Before installing or using it:
- Treat the repository as unverified (source/homepage unknown). Prefer official or well-known integrations when possible.
- Inspect scripts/digitalocean.py yourself (you already ha...详细分析 ▾
ℹ 用途与能力
The name, description, SKILL.md and the included Python script all align: the code calls the official DigitalOcean API and implements droplets, DNS, firewalls, spaces, databases, billing, SSH keys, images, etc. There are no obvious unrelated capabilities (no calls to non-DigitalOcean endpoints). However the registry metadata claims 'instruction-only' / no install but does include a code file, which is an inconsistency (minor but worth noting).
✓ 指令范围
SKILL.md instructs the agent (and the user) to store a DigitalOcean API token at ~/.config/digitalocean/token and to call the bundled script or the DigitalOcean API directly. The runtime instructions and script stay within the stated domain (DigitalOcean API). The instructions do not ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints.
ℹ 安装机制
There is no install spec (no packages downloaded), which is low risk. But the package is not truly 'instruction-only' — it bundles scripts/digitalocean.py that will be executed locally. That mismatch is informational: the code is included and will run when invoked, but nothing is installed automatically.
⚠ 凭证需求
SKILL.md and the script require a DigitalOcean API token stored at ~/.config/digitalocean/token, yet the registry metadata declares no primary credential, required env vars, or required config paths. This omission is an inconsistency that matters: the skill does require a secret (API token) with potentially broad privileges, but that requirement is not declared in the metadata. Users should treat this as suspicious until the credential requirements are explicit. Also SKILL.md suggests 'Spaces (requires spaces key)' which implies additional credentials; the metadata does not reflect that either.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide settings. It only reads a token file from the user's home directory when invoked. Autonomous invocation (disable-model-invocation:false) is the platform default and not highlighted here; combined with the credential omission above it increases risk, but on its own this is normal.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/10
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install digitalocean
镜像加速npx clawhub@latest install digitalocean --registry https://cn.longxiaskill.com