by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's stated purpose (orchestrating AI CLIs) is plausible, but the instructions and included script do things that are inconsistent or broader than necessary (sourcing your shell rc, reading ambiguous config paths, and relying on weak checks for API validity), so review before use.
评估建议
This skill is broadly coherent with its stated aim, but exercise caution before installing or running it:
- Inspect $HOME/.zshrc and any project .env/.ai-config* files referenced by the skill. The included script explicitly sources $HOME/.zshrc, which executes whatever is in that file in the current shell — this can run code or expose environment variables (API keys).
- Note inconsistent config paths in SKILL.md vs. the script (several different filenames). Ask the author which files the skill ...详细分析 ▾
ℹ 用途与能力
The overall purpose (discover installed AI CLIs, prioritize, and fallback) matches the provided script and SKILL.md. However, there are mismatches in config file names/locations (.ai-cli-orchestrator.yaml, .ai-config.yaml, ~/.ai-cli-config.json) and the described 'verify API key validity' step is implemented only as --version/--help checks, which do not validate credentials.
⚠ 指令范围
Runtime instructions explicitly tell the agent to read project files (.ai-config.yaml, .env), pass git diffs and file snapshots between tools, and the included script sources $HOME/.zshrc. Those actions expand scope into reading local secrets/configuration and executing whatever is in a user's shell rc — behavior that is not strictly necessary to 'detect installed CLI binaries' and can expose sensitive data or execute unintended code.
✓ 安装机制
No install spec is provided (instruction-only skill) and the only shipped code is a small shell script. This minimizes install-time risk because nothing is downloaded or extracted from remote URLs.
⚠ 凭证需求
The skill declares no required environment variables, yet its instructions and script read/suggest reading .env, .ai-config.yaml, and source $HOME/.zshrc to obtain environment information. Requesting/dereferencing those files without declaring them is disproportionate and could lead to accidental use of credentials found there.
ℹ 持久化与权限
The skill writes a configuration file to $HOME/.ai-cli-config.json (persistence in the user's home). It does not request always:true or system-wide modification rights, which is appropriate, but the file-write behavior should be noted and confirmed acceptable by the user.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/16
ai-cli-orchestrator v1.0.3 - Updated `scripts/scan_ai_tools.sh` (details of specific code changes not shown). - No changes to documentation or core functionality described in SKILL.md.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install ai-cli-orchestrator
镜像加速npx clawhub@latest install ai-cli-orchestrator --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制