by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (AI workplace inspection with Feishu alerts) is plausible, but there are several inconsistencies and unclear data-flow details (where credentials/config are stored, differing config paths in docs vs code, and broad runtime capabilities like exec/web_fetch) that warrant caution before installing.
评估建议
Before installing or running this skill: 1) Review and confirm where sensitive credentials will be stored — SKILL.md says ~/.openclaw/workspace/..., but the included index.js writes config.json in the skill directory. Decide which behavior you want and adjust the code or config accordingly. 2) Do not put production camera access tokens or Feishu bot secrets into the skill until you verify where they are stored and who/what can read them. Prefer short-lived credentials or per-skill scoped tokens ...详细分析 ▾
ℹ 用途与能力
The skill's name, description, and SKILL.md describe camera capture, AI image analysis, and Feishu alerts — all coherent. It relies on platform tools (message, web_fetch/exec, AI model) rather than embedding heavy dependencies, which is reasonable. Minor inconsistencies: the published skill slug/name is "employee-off-duty-detection-2" while SKILL.md and files use "intelligent-inspection"; SKILL.md says config lives in ~/.openclaw/workspace/intelligent-inspection-config.json but the included index.js writes/reads a local config.json in the skill directory. These mismatches could cause confusion about where sensitive credentials end up.
⚠ 指令范围
SKILL.md instructs the agent to capture camera images, generate AI analysis, and send alerts via platform channels using tools such as web_fetch and exec. That scope is expected for this functionality but also gives the skill the ability to call arbitrary HTTP endpoints and run shell commands — which can be abused to exfiltrate images or credentials if misused. The SKILL.md explicitly says it will save configuration to a home-path (~/.openclaw/...), but the shipped index.js actually saves to a local config.json — this contradiction is important because the documented path implies different access/retention semantics than the code implements.
✓ 安装机制
There is no install spec (instruction-only behavior) and the included code is small and local. No downloads from remote URLs or package installs are requested. This is lower risk than an external installer, but presence of executable code (index.js) means you should review it before running.
ℹ 凭证需求
The skill legitimately needs camera API credentials and Feishu bot tokens for its task; SKILL.md describes storing them in a config file. However, the registry metadata lists no required env vars and no required config paths, which is inconsistent with runtime needs. The config/credential storage location is unclear (docs -> home path; code -> local skillDir). Storing long-lived camera or messaging tokens in an editable JSON file can be reasonable but requires the user to ensure it's stored securely and that retention behavior matches expectations.
✓ 持久化与权限
The skill is not forced always-on and uses normal agent invocation. It does not request any platform-level privileges in the manifest. Autonomous invocation is allowed (the platform default) but does not by itself increase the assessed risk here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/10
**Major update: Enhanced from basic off-duty detection to a flexible, intelligent inspection system.** - Introduced a guided, user-friendly setup wizard for camera and task configuration. - Added modular config file support, replacing in-code settings with isolated JSON config. - Expanded inspection beyond employee attendance: supports customizable prompts and multiple use cases (security, compliance, equipment). - Integrated robust AI-powered analysis and structured alerting, with multi-channel support (Feishu primary, with fallback). - Simplified file structure and improved maintainability; obsolete scripts removed and new entrypoint and config templates added.
● 可疑
安装命令
点击复制官方npx clawhub@latest install employee-off-duty-detection-2
镜像加速npx clawhub@latest install employee-off-duty-detection-2 --registry https://cn.longxiaskill.com