by 安全扫描
OpenClaw
安全
medium confidence该技能基本如描述所述，运行本地脚本与本地 LLM 委员会后端交互，返回主席的综合答案，但安装前应注意几点小问题。
评估建议
该技能与其声明目的一致，风险较低，但安装前请检查：1) 脚本需要 `curl` 和 `python3`，但技能元数据未声明；确保环境中有这些依赖。2) 脚本与本地主机（127.0.0.1:8001）后端交互，并构造本地 Web UI URL（端口 5173）。仅在信任/运行 LLM 委员会后端的机器或网络上使用。3) 包不安装后端；`SKILL.md` 建议单独运行 `/install-llm-council` — 确认安装程序来源。4) 包含的小脚本可读（无混淆代码），但由于将在本地执行，如果不确定，请自行审查或在安全环境中运行。若需更高的保证，请向作者请求明确的必需二进制文件列表和后端安装文档；解决这些问题将提高信心到高级。...详细分析 ▾
ℹ 用途与能力
The skill's name/description (quick headless access to an LLM Council) matches the behavior in ask-council.sh: it creates a conversation, starts a run, polls until completion, and prints the chairman's answer. However, the script depends on curl and python3 (used for JSON parsing) and expects network access to localhost ports 8001/5173, yet the skill declares no required binaries or environment variables — this mismatch is operationally important though not malicious.
✓ 指令范围
SKILL.md instructs the agent to run the included shell script with the user's question. The script only interacts with a local backend (API_BASE=http://127.0.0.1:8001), polls for status, and prints a local web-UI link; it does not reach out to arbitrary external hosts or attempt to read unrelated files or secrets.
ℹ 安装机制
This is an instruction-only skill with a bundled script (no install spec). That is low risk, but because the script will be executed on the host, users should confirm the script's contents (which were provided) and be aware there is no automated package installation. The SKILL.md references an external repo and a /install-llm-council step, but the skill package does not provide or install the backend.
✓ 凭证需求
The skill requests no environment variables or external credentials and the script does not attempt to access secrets or unrelated config paths. Its only system interactions are network calls to localhost and a call to hostname -I to display a local IP.
✓ 持久化与权限
always is false and the skill does not request persistent system privileges or modify other skills or system-wide settings. It runs a single script per invocation and creates ephemeral conversations on the backend.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.42026/2/22
Clean up - working short URL support, outputs conversation link
● 无害
安装命令 点击复制
官方npx clawhub@latest install ask-council
镜像加速npx clawhub@latest install ask-council --registry https://cn.clawhub-mirror.com
技能文档
简介
直接从 Telegram 或聊天界面询问 LLM 委员会，获取主席的综合答案，无需打开 Web 界面。快速、无头访问多模型...安装
运行/install-llm-council 安装后端（详见 SKILL.md）使用
在 Telegram/聊天中输入问题，获取综合答案注意：请确保环境满足依赖，且信任后端来源。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制