by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, runtime instructions, and required environment variables are consistent with a Grok/xAI client: it only needs node and an XAI_API_KEY and talks to api.x.ai for chat, vision, and X search functionality.
评估建议
This skill appears coherent and limited to acting as an xAI/Grok client. Before installing: (1) confirm you trust the skill source (the repository owner is unknown here); (2) only provide a dedicated xAI API key (avoid reusing broad or admin keys) and consider key rotation; (3) review the bundled scripts yourself if you have doubts — they read any image path you pass (so avoid sending sensitive images); (4) be aware network requests go to api.x.ai (inspect network policy if you require allowlist...详细分析 ▾
✓ 用途与能力
The name/description (xAI / Grok) aligns with the included scripts: chat.js, models.js, and search-x.js. Requested binary (node) and primary env var (XAI_API_KEY) are exactly what a client for xAI would need.
✓ 指令范围
SKILL.md and the scripts limit behavior to sending prompts/images to api.x.ai and listing models; image uploads are constrained to specific extensions. The scripts do not read arbitrary config files or extra environment variables beyond XAI_API_KEY/XAI_MODEL. There are no instructions to transmit data to endpoints other than api.x.ai.
✓ 安装机制
No install spec — code files are bundled and executed via node. No downloads or archive extraction are performed by the skill itself; risk from installation is low.
✓ 凭证需求
Only XAI_API_KEY (and optional XAI_MODEL) are required. These credentials are proportional and necessary for the described functionality; no unrelated secrets or config paths are requested.
✓ 持久化与权限
The skill does not request always:true and declares disable-model-invocation:true (no autonomous invocation). It does not modify other skills or system-wide config and does not persist credentials itself.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/2/21
- Added a prominent link to external installation and use instructions at the top of the setup section. - No changes to functionality or commands; documentation update only.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install x-ai
镜像加速npx clawhub@latest install x-ai --registry https://www.longxiaskill.com
技能文档
Chat with xAI's Grok models. Supports text and vision.
Setup
INSTALLATION AND USE INSTRUCTIONS
export XAI_API_KEY="xai-YOUR-KEY"
Get your API key at: https://console.x.ai
Commands
Chat with Grok
node {baseDir}/scripts/chat.js "What is the meaning of life?"
Use a specific model
node {baseDir}/scripts/chat.js --model grok-3-mini "Quick question: 2+2?"
Vision (analyze images)
node {baseDir}/scripts/chat.js --image /path/to/image.jpg "What's in this image?"
🔍 Search X/Twitter (Real-time!)
node {baseDir}/scripts/search-x.js "Remotion video framework"
node {baseDir}/scripts/search-x.js --days 7 "Claude AI tips"
node {baseDir}/scripts/search-x.js --handles @remotion_dev "updates"
Uses xAI Responses API with x_search tool for real X posts with citations.
List available models
node {baseDir}/scripts/models.js
Available Models
grok-3- Most capable, best for complex tasksgrok-3-mini- Fast and efficientgrok-3-fast- Optimized for speedgrok-2-vision-1212- Vision model for image understanding
Example Usage
User: "Ask Grok what it thinks about AI safety" Action: Run chat.js with the prompt
User: "Use Grok to analyze this image" (with attached image) Action: Run chat.js with --image flag
User: "What Grok models are available?" Action: Run models.js
API Reference
xAI API Docs: https://docs.x.ai/api
Environment Variables
XAI_API_KEY- Your xAI API key (required)XAI_MODEL- Default model (optional, defaults to grok-3)
Security & Permissions
What this skill does:
- Sends chat prompts to xAI's API at
api.x.ai - Vision mode sends images to xAI for analysis
scripts/models.jslists available models (read-only)
What this skill does NOT do:
- Does not read arbitrary local files —
--imageonly accepts files with image extensions (.jpg,.jpeg,.png,.gif,.webp) - Does not read config files or access the filesystem beyond the specified image path
- Does not store conversation history or logs
- Does not send credentials to any endpoint other than
api.x.ai - Cannot be invoked autonomously by the agent (
disable-model-invocation: true)
Bundled scripts: scripts/chat.js (chat), scripts/models.js (list models), scripts/search-x.js (X search)
Review scripts before first use to verify behavior.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制