by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: configure OpenClaw to use a local Ollama embedding model. Before installing: 1) ensure you have OpenClaw installed (the SKILL.md expects the 'openclaw' CLI) and Ollama downloaded from the official site; 2) keep Ollama bound to localhost (127.0.0.1) as recommended to avoid exposing the local embedding API to the network; 3) be cautious when adding extraPaths — pointing OpenClaw at arbitrary absolute directories can cause sensitive files to be indexed; and 4)...详细分析 ▾
ℹ 用途与能力
The name/description match the instructions: it configures OpenClaw to use Ollama + nomic-embed-text. One small inconsistency: the runtime instructions call 'openclaw gateway restart' but the skill's declared required binaries list does not include the openclaw CLI. That omission is minor (the skill necessarily assumes OpenClaw is already installed), but the registry metadata should list openclaw if the skill expects it to be present.
ℹ 指令范围
Instructions stay within the stated purpose (pull a local model, point OpenClaw at a local Ollama API, and restart the gateway). They reference editing ~/.openclaw/openclaw.json and optionally adding 'extraPaths' (absolute or relative) which OpenClaw will scan recursively for .md files — this is expected for a memory-indexing feature but carries the usual risk that if you configure extraPaths to system or sensitive directories, those files may be indexed. The SKILL.md does not instruct reading arbitrary system files or contacting external endpoints beyond ollama.ai (download page) and the local Ollama API at 127.0.0.1.
✓ 安装机制
This is instruction-only (no install spec). It points users to download Ollama from the official site and to run 'ollama pull'. No archives or third-party download URLs are embedded in the skill itself. This keeps the install risk low, though users should verify they download Ollama from the official domain.
✓ 凭证需求
The skill requests no environment variables or credentials and only requires local binaries (ollama, curl). That is proportionate for a local embedding provider. No unrelated cloud API keys or secret variables are requested.
✓ 持久化与权限
The skill does not request always: true or any elevated platform privileges. It is user-invocable and may be invoked autonomously per platform defaults, which is appropriate for an integration helper. It does not attempt to modify other skills' configs; it only instructs the user to update OpenClaw's own config file.
安全有层次，运行前请审查代码。
运行时依赖
🖥️ OSLinux · macOS · Windows
版本
latestv1.1.02026/3/30
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install openclaw-ollama-memory
镜像加速npx clawhub@latest install openclaw-ollama-memory --registry https://cn.longxiaskill.com镜像同步中