by 安全扫描
OpenClaw
可疑
high confidenceThe skill appears to implement a legitimate Fanvue API integration, but its manifest/registry metadata does not match the runtime instructions (the SKILL.md requires OAuth client id/secret and redirect URI, while the registry lists no required env vars), and the publisher/source is unknown — proceed only after verifying provenance and credential handling.
评估建议
What to check before installing/using this skill:
- Provenance: the skill's source/homepage is missing and the owner id is unfamiliar. Prefer skills with a documented homepage or known publisher. Ask the publisher for a repository or contact info.
- Metadata mismatch: the registry lists no required env vars, but SKILL.md and examples require FANVUE_CLIENT_ID, FANVUE_CLIENT_SECRET, and FANVUE_REDIRECT_URI. Confirm with the publisher why the manifest omits these and ensure the platform will prom...详细分析 ▾
ℹ 用途与能力
Name/description, SKILL.md, api-reference and example code all consistently target Fanvue creator account management (posts, chats, media, subscribers, earnings). The requested OAuth scopes and API endpoints align with that purpose. However the registry metadata claims no required environment variables or primary credential while the SKILL.md and code explicitly require FANVUE_CLIENT_ID, FANVUE_CLIENT_SECRET, and FANVUE_REDIRECT_URI — a clear metadata mismatch.
✓ 指令范围
The SKILL.md instructions and included example code limit actions to Fanvue API calls (auth flow, listing media, posts, messages, insights). There are no instructions to read unrelated local files, system config, or send data to third-party endpoints beyond Fanvue auth/api domains.
✓ 安装机制
No install spec is present (instruction-only with example code). That minimizes install-time risk — nothing is downloaded or written by an installer. The code files are example helpers and API schemas; no build/install steps are declared.
⚠ 凭证需求
SKILL.md and the example code require FANVUE_CLIENT_ID, FANVUE_CLIENT_SECRET, and FANVUE_REDIRECT_URI and describe requesting sensitive OAuth scopes (offline_access, read:subscribers, read:insights, write:chat, write:post). Those are appropriate for the declared functionality, but the registry metadata incorrectly lists no required env vars/credentials. Because the skill needs confidential credentials (client secret) and will obtain access/refresh tokens that grant account-level actions (posting, messaging, reading earnings/subscriber lists), the mismatch in declared credentials is a meaningful red flag and warrants verification before granting secrets.
✓ 持久化与权限
The skill is not marked always:true and does not request system-level persistence. It will operate via OAuth tokens (which grant account access), and the platform default allows autonomous invocation; that is normal for a skills integration. There is no evidence the skill modifies other skills or system configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/1
Fanvue skill initial release. - Integrates with Fanvue via OAuth 2.0 (PKCE) for secure authentication. - Provides guides and TypeScript snippets for managing chats, posts, media, subscribers, and earnings. - Details required OAuth scopes and request headers. - Explains media access workflow using signed URLs and media variants. - Covers core API operations: messaging, posting, audience management, and earnings retrieval. - Designed for automating creator accounts and agent workflows.
● 无害
安装命令
点击复制官方npx clawhub@latest install fanvue
镜像加速npx clawhub@latest install fanvue --registry https://cn.longxiaskill.com