by 下载技能包
最后更新
2026/4/20
安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions are coherent for a DDNS service, but it directs users to download a Windows client from an untrusted HTTP endpoint and includes minor inconsistencies in domain/host naming — proceed with caution.
评估建议
This skill's written instructions match a DDNS service, but exercise caution before following the Windows client download link: the binary is served over plain HTTP from a nonstandard host/port (nas.yinze.run:2018), which allows tampering in transit and is not an established release host. Before installing, verify the publisher and prefer an HTTPS download or an official release page. If you must test it, run the client inside an isolated VM or sandbox, scan the binary with up-to-date antivirus,...详细分析 ▾
ℹ 用途与能力
The name/description (Free DDNS) match the SKILL.md instructions (API update endpoint, curl example, registering for a subdomain). However there is a small inconsistency: the service site is ddns.yinze.run while example hostnames use the domain 1798.cloud and the Windows client is served from nas.yinze.run:2018 — this multi-host setup is plausible but unexplained and worth verifying.
⚠ 指令范围
Instructions themselves are limited to registering, calling the update API (curl -u username:password), and downloading/installing a Windows client. The concerning part is the client download: a direct HTTP URL on a nonstandard port (http://nas.yinze.run:2018/...) is provided and the doc says the client "auto-runs in background" after install — that implies persistent behavior and potentially elevated OS-level effects not visible from the SKILL.md. The SKILL.md does not instruct the agent to read unrelated files or system state, but it does encourage installing an opaque binary from an untrusted host.
⚠ 安装机制
There is no formal install spec for the skill itself (instruction-only), but the runtime instructions point users to download a 48MB Windows client over plain HTTP from nas.yinze.run:2018. Downloading and executing binaries from an unverified HTTP endpoint is high risk: the transport is not encrypted and the origin is not a known trusted release host.
✓ 凭证需求
The skill declares no required environment variables or credentials; the SKILL.md expects service credentials (username:password) for the DDNS API via basic auth in the curl example, which is proportionate and expected for a DDNS update workflow. No unrelated secrets or system config paths are requested.
ℹ 持久化与权限
The skill metadata does not request persistent agent privileges (always:false) and is user-invocable. However, the recommended Windows client is described as auto-starting and running in the background after installation — this creates persistence on the user's machine independent of the skill metadata and is a relevant security consideration for users.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/4/20
Version 1.0.2 of free-ddns contains no changes from the previous version. - No file changes detected in this release.
● 可疑
安装命令
点击复制官方npx clawhub@latest install free-ddns
镜像加速npx clawhub@latest install free-ddns --registry https://cn.longxiaskill.com镜像同步中