by 安全扫描
OpenClaw
可疑
medium confidenceThe skill is an instruction-only helper for Alibaba Cloud DNS using the aliyun CLI and looks generally coherent, but its published metadata omits the fact that it needs user AK/SK credentials (and hints at environment variables), which is an important mismatch you should review before installing.
评估建议
This skill appears to do what it says (manage Alibaba Cloud DNS with aliyun-cli), but before using it: 1) be aware it requires your Alibaba Cloud Access Key ID and Secret — do not provide root or overly powerful keys; create least-privilege keys for DNS changes. 2) The registry metadata did not declare these required credentials — treat that omission as a red flag and confirm how/when credentials are used. 3) Review the download URL (aliyuncli.alicdn.com) and, if possible, verify checksums from ...详细分析 ▾
ℹ 用途与能力
The name/description match the instructions: it is explicitly a helper for managing Alidns via aliyun-cli and for CNAME setup for Function Compute. The steps and API calls in SKILL.md are consistent with that purpose.
✓ 指令范围
SKILL.md stays on-topic: it instructs installing aliyun-cli, configuring Alibaba Cloud credentials, running DescribeSubDomainRecords and AddDomainRecord, and saving outputs. It does not instruct reading unrelated system files or exfiltrating data to third-party endpoints.
ℹ 安装机制
The install instructions use curl to download a tarball from aliyuncli.alicdn.com (an Alibaba CDN domain referenced in the official docs). Using curl+extract is expected for installing a CLI but bears the usual risks of arbitrary binary installs; this is proportionate for a CLI helper but users should verify the URL and checksum before running.
⚠ 凭证需求
Registry metadata lists no required environment variables or primary credential, but SKILL.md clearly requires Alibaba Cloud access keys (and suggests ALICLOUD_ACCESS_KEY_ID/ALICLOUD_ACCESS_KEY_SECRET and optional region). This mismatch (metadata omission) is a notable incoherence — the skill will require secret credentials to operate, and that should be declared up front.
✓ 持久化与权限
The skill is instruction-only, has no install spec in registry, and does not request always:true. Autonomous invocation is allowed by default (normal), but the skill itself does not request elevated or persistent platform privileges. The aliyun CLI configuration step will persist credentials locally (per normal CLI behavior).
安装前注意事项
- be aware it requires your Alibaba Cloud Access Key ID and Secret — do not provide root or overly powerful keys; create least-privilege keys for DNS changes.
- The registry metadata did not declare these required credentials — treat that omission as a red flag and confirm how/when credentials are used.
- Review the download URL (aliyuncli.alicdn.com) and, if possible, verify checksums from official docs before running the curl/install steps.
- Ensure the agent or skill will ask for explicit confirmation before performing mutating operations (AddDomainRecord).
- After testing, remove or rotate any credentials stored by the CLI if you no longer need them. If you need higher assurance, ask the publisher to update the registry metadata to list the required env vars and to provide checksums or a vetted install mechanism.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/2/11
batch publish from alicloud-skills on 2026-03-11
● 无害
安装命令 点击复制
官方npx clawhub@latest install alicloud-network-dns-cli
镜像加速npx clawhub@latest install alicloud-network-dns-cli --registry https://cn.clawhub-mirror.com
技能文档
Category: tool
# Alibaba Cloud DNS (Alidns) CLI
Goals
- Query and manage Alibaba Cloud DNS records via
aliyun-cli. - Quickly configure CNAME for Function Compute custom domains.
When to Use
- When you need to add/update DNS records in Alibaba Cloud DNS.
- When you need CNAME setup for FC custom domains.
Install aliyun-cli (without sudo)
curl -fsSL https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz -o /tmp/aliyun-cli.tgz
mkdir -p ~/.local/bin
tar -xzf /tmp/aliyun-cli.tgz -C /tmp
mv /tmp/aliyun ~/.local/bin/aliyun
chmod +x ~/.local/bin/aliyun
Configure Credentials
~/.local/bin/aliyun configure set \
--profile default \
--access-key-id \
--access-key-secret \
--region cn-hangzhou
Configure region as default; if best region is unclear, ask the user.
Query DNS Records
Query subdomain records:
~/.local/bin/aliyun alidns DescribeSubDomainRecords \
--SubDomain news.example.com
Add CNAME Record
~/.local/bin/aliyun alidns AddDomainRecord \
--DomainName example.com \
--RR news \
--Type CNAME \
--Value
FC Custom Domain CNAME Target
Custom domain should point to FC public CNAME:
..fc.aliyuncs.com
Example (Hangzhou):
1629965279769872.cn-hangzhou.fc.aliyuncs.com
Common Issues
- If apex CNAME is not supported, use subdomain like
wwwor ALIAS/ANAME records. - Create FC custom domain only after DNS propagation, otherwise
DomainNameNotResolvedmay occur.
References
- aliyun-cli installation
- Alidns API（AddDomainRecord / DescribeSubDomainRecords）
- FC custom domain configuration and CNAME guidance
- Official source list:
references/sources.md
Validation
mkdir -p output/alicloud-network-dns-cli
echo "validation_placeholder" > output/alicloud-network-dns-cli/validate.txt
Pass criteria: command exits 0 and output/alicloud-network-dns-cli/validate.txt is generated.
Output And Evidence
- Save artifacts, command outputs, and API response summaries under
output/alicloud-network-dns-cli/. - Include key parameters (region/resource id/time range) in evidence files for reproducibility.
Prerequisites
- Configure least-privilege Alibaba Cloud credentials before execution.
- Prefer environment variables:
ALICLOUD_ACCESS_KEY_ID,ALICLOUD_ACCESS_KEY_SECRET, optionalALICLOUD_REGION_ID. - If region is unclear, ask the user before running mutating operations.
Workflow
1) Confirm user intent, region, identifiers, and whether the operation is read-only or mutating. 2) Run one minimal read-only query first to verify connectivity and permissions. 3) Execute the target operation with explicit parameters and bounded scope. 4) Verify results and save output/evidence files.
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制