by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to check before installing:
- The script will read your flomo webhook URL from ~/.flomo_token and send any invoked content to that URL. Only install if you trust the webhook endpoint.
- Ensure the webhook file is created by you and stored securely (e.g., chmod 600 ~/.flomo_token). Do not paste secrets from other services into that file.
- The bundled script uses curl and jq; install those on your system or expect the skill to fail. The manifest should have listed these dependencies but did ...详细分析 ▾
ℹ 用途与能力
The skill's name/description (sync to flomo) aligns with the included script: the script reads a webhook URL and POSTs note content to it. However, the registry metadata claims no required config paths or credentials while both SKILL.md and scripts/flomo.sh require a ~/.flomo_token file — a manifest mismatch that should have been declared.
✓ 指令范围
SKILL.md and the script are narrowly scoped: they read the webhook from ~/.flomo_token and send provided content to that webhook. The instructions do not request unrelated files, environment variables, or external endpoints beyond the webhook. They do, however, rely on running curl and jq (used in the script) which are not listed in the manifest.
✓ 安装机制
No install spec (instruction-only) and the included script is a small shell file bundled with the skill. There are no remote downloads or archive extraction steps. This is low-risk from an install-source perspective.
ℹ 凭证需求
The only secret/credential involved is the flomo webhook URL stored in ~/.flomo_token, which is proportionate to the stated purpose. But the skill metadata did not declare this config path, and the script will transmit any content it is given to that webhook — users should ensure the webhook target is trusted and the token file is securely stored.
✓ 持久化与权限
The skill does not request always:true and does not modify other skills or system-wide settings. It runs only when invoked and has no elevated or persistent platform-wide privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/3
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install ye-flomo-sync
镜像加速npx clawhub@latest install ye-flomo-sync --registry https://cn.longxiaskill.com镜像同步中