安全扫描
OpenClaw
安全
high confidence该技能是一个简单的本地 CLI,用于记录和导出游戏得分,仅写入用户主目录下的纯文本文件。代码和指令在少数文档/格式不匹配之外是一致的。
评估建议
该技能仅为本地使用,似乎如其所言:记录条目并从 ~/.local/share/score 导出/搜索。安装前,请注意:(1) 脚本将在 ~/.local/share/score 创建和写入纯文本文件;(2) SKILL.md 提到 SCORE_DIR,但脚本不遵守此变量;(3) JSON 导出代码有小 bug;(4) 历史时间戳格式与其他日志不同;(5) 无网络调用或凭证请求。建议在沙盒或专用账户中检查脚本后再使用。...详细分析 ▾
✓ 用途与能力
Name/description (score, leaderboards, stats) align with what the included script does: it logs entries, shows recent items, performs simple stats, search, and exports. No unrelated credentials, binaries, or cloud access are requested.
ℹ 指令范围
SKILL.md describes only local file operations and CLI usage, which matches the script. Minor mismatches: SKILL.md claims you can override the data directory with SCORE_DIR environment variable, but the script always uses DATA_DIR="${HOME}/.local/share/score" and does not read SCORE_DIR. Also the _log() timestamp format (used for history.log) is month-day while individual command entries use a year-month-day format; this is an internal consistency/documentation issue but not a secret-exfiltration risk.
✓ 安装机制
Instruction-only skill plus a single bash script; there is no install spec and nothing is downloaded from external URLs. No archive extraction or third-party package installs are present.
✓ 凭证需求
The skill requests no environment variables or credentials. SKILL.md mentions SCORE_DIR as a possible override, but the shipped script doesn't honor it — that's a documentation/code mismatch (not an overbroad permission request).
✓ 持久化与权限
The script writes only to ~/.local/share/score by default (creates that directory). The skill is not marked always:true and does not modify other skills or system-wide settings. It does not persist beyond creating its own files in the user's home directory.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.22026/3/16
更新
● 无害
安装命令 点击复制
官方npx clawhub@latest install score
镜像加速npx clawhub@latest install score --registry https://cn.clawhub-mirror.com
技能文档
用于从命令行跟踪得分、排名、挑战、排行榜和奖励。记录条目、查看历史、导出数据和搜索所有记录。
概述
Score 是一个多功能的 CLI 工具,用于游戏和竞赛跟踪。每个命令记录或检索带有时间戳的条目。传递参数记录新数据,或者运行不带参数的命令查看最近的条目。内置实用程序提供统计数据、数据导出、搜索和健康检查。... (以下内容与原文相同,未翻译代码块、命令行指令和 Markdown 格式) ...
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制