📦 Farmos Land Portfolio — 土地资产查询
v1.0.0一站式查询土地所有权、租约、地主信息与付款记录，并支持付款管理及租约续签的写入操作。
0· 490·2 当前·2 累计
by @brianppetty下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
Do not install or enable this skill until you validate a few things: (1) Confirm the skill's origin and trustworthiness — the repo/source is unknown. (2) Inspect ~/clawd/scripts/farmos-auth.sh and ~/.openclaw/farmos-users.json yourself to ensure they are legitimate and do not leak secrets or run unsafe commands. (3) Require the skill to declare the config paths and any credentials it needs in its metadata (e.g., config_paths for the users JSON and an explicit note that it will execute a local au...详细分析 ▾
⚠ 用途与能力
The declared purpose (query/manage land, payments, lease renewals) legitimately includes read and write operations. However, the skill's instructions expect access to a local auth helper (~/clawd/scripts/farmos-auth.sh) and a role file (~/.openclaw/farmos-users.json) which are not declared in the metadata. Either those local artifacts should be declared as required config/credentials or the instructions are incomplete/opaque.
⚠ 指令范围
SKILL.md explicitly directs the agent to read a local file (~/.openclaw/farmos-users.json) to validate roles and to run a shell script in the user's home to obtain an admin JWT. Those are file- and execution-level actions outside the metadata's declared scope. The instructions also require using admin-level tokens to perform write operations (mark payments paid, renew leases) — potentially destructive if misused.
✓ 安装机制
There is no install spec and no code files, so nothing will be written to disk by an installer. This lowers installation risk. The remaining risk derives from runtime instructions that execute local scripts and call network endpoints.
⚠ 凭证需求
The skill requires JWTs for write actions and prescribes a local script to obtain them, but the registry lists no required environment variables, credentials, or config paths. The skill also instructs the agent to read a local role file — a capability that should be declared and permissioned. The lack of declared credentials/config paths is a proportionality mismatch.
ℹ 持久化与权限
The skill is not force-included (always:false) and allows user invocation; autonomous invocation is permitted by platform default. Because the skill can obtain admin JWTs and perform writes, you should consider restricting autonomous invocation or requiring explicit user confirmation before any write operation. The skill does not request persistent platform privileges in its metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/22
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install farmos-land-portfolio
镜像加速npx clawhub@latest install farmos-land-portfolio --registry https://cn.longxiaskill.com