by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill behaves as documented: it sends requested URLs and their contents to the Distil proxy (https://proxy.distil.net by default) using your DISTIL_API_KEY. Before installing, consider whether you trust Distil with any pages you may request—do not ask the skill to fetch internal, intranet, or other sensitive URLs unless you trust the proxy or self-host it via DISTIL_PROXY_URL. Keep your DISTIL_API_KEY secret and consider using a scoped/revocable key or a self-hosted proxy if privacy is a co...详细分析 ▾
✓ 用途与能力
Name/description match the required resources and instructions. Requiring curl and DISTIL_API_KEY is proportional to a skill that calls the Distil proxy; no unrelated binaries or credentials are requested.
ℹ 指令范围
SKILL.md only instructs the agent to make curl requests to the Distil proxy (configurable via DISTIL_PROXY_URL) and to write responses to stdout or a file (e.g., screenshot.png). This stays within the stated purpose, but be aware that any URL you ask the skill to fetch (and the content of that page) will be transmitted to the Distil service—so fetching internal, private, or sensitive URLs could leak data to a third party.
✓ 安装机制
Instruction-only skill with no install spec or code downloads; lowest-risk installation surface (relies on an existing curl binary).
✓ 凭证需求
Only DISTIL_API_KEY (primary credential) is required, plus an optional DISTIL_PROXY_URL. The requested environment access is minimal and appropriate for the described functionality. Treat the API key as sensitive.
✓ 持久化与权限
always is false and the skill does not request persistent system-wide privileges or modify other skills' configs. Autonomous invocation is allowed (platform default) but not excessive in itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.12026/2/21
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install distil
镜像加速npx clawhub@latest install distil --registry https://cn.longxiaskill.com