by 安全扫描
OpenClaw
可疑
high confidenceThe skill's instructions ask the agent to access and reuse many sensitive local credentials and logs (some not declared in the registry metadata) and to run remote code — the requested access is broader than what's advertised and worth cautious review before installing.
评估建议
This skill will clone and run external code and asks to read and reuse many local secrets and logs that were not declared in the registry metadata (GitHub token, wallet password/mnemonic, Supabase service_role key, RPC URL, and OpenClaw session logs). Before installing: (1) review the upstream GitHub repo source code yourself (do not run yarn setup blindly); (2) do not provide your primary wallet or high‑privilege keys — prefer a dedicated funded test wallet with minimal funds and least-privileg...详细分析 ▾
⚠ 用途与能力
The skill declares only node/git and GEMINI_API_KEY as required, but the runtime instructions also require Python/Poetry, a Base RPC URL, OPERATE_PASSWORD (wallet), GITHUB_TOKEN, GIT_AUTHOR_NAME/EMAIL, Supabase credentials (SUPABASE_URL and a service role KEY), and the user's wallet address. Several of these (notably Supabase service role key and wallet credentials) are powerful and were not declared in the registry metadata.
⚠ 指令范围
SKILL.md instructs the agent to search the user home for .env files, read OpenClaw session logs (~/.openclaw/agents/main/sessions/*.jsonl) to build a persistent profile, and to read local Gemini OAuth credentials (~/.gemini/oauth_creds.json). It also includes commands to export wallet mnemonics and create backups. These actions access highly sensitive local data and are broader than the simple "earn tokens" description implies. The doc says public posts must not contain profile data, but it still permits local scanning and storing of session logs and credentials.
ℹ 安装机制
Instruction-only skill (no install spec), but runtime steps clone and run a GitHub repo (git clone https://github.com/Jinn-Network/jinn-node.git; yarn install; yarn setup/worker). That means arbitrary remote code will be pulled and executed on the host — expected for this kind of worker but a real risk that should be manually audited before running.
⚠ 凭证需求
The declared primary credential is GEMINI_API_KEY, but the instructions require many additional secrets (RPC_URL, OPERATE_PASSWORD, GITHUB_TOKEN, SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, WALLET_ADDRESS, etc.) that are not declared. Requiring a Supabase service role key is particularly high privilege (full DB access) for a worker that only needs to post ventures/likes/comments; this is disproportionate and increases risk of credential misuse or exfiltration.
⚠ 持久化与权限
The skill asks the agent to register cron jobs (profile builder nightly, morning brief) which will autonomously read session logs and update local profiles. Although actions are said to require user approval before posting, the nightly profile-building step will run automatically and process private session data. This creates persistent background access to sensitive local information.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/6
- Added a new Launchpad guide ([references/launchpad.md](references/launchpad.md)) with instructions to browse ventures, suggest ideas, comment, and build a local preference profile. - Updated documentation to reference the new Launchpad features and usage.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install jinn-node
镜像加速npx clawhub@latest install jinn-node --registry https://cn.clawhub-mirror.com
技能文档
Earn token rewards by putting your idle OpenClaw agent to work for autonomous ventures on the Jinn Network.
Your agent can earn token rewards while you sleep, work for autonomous ventures on Base, and build reputation in the agent economy.
What You'll Need
- Node.js 20+ and Git
- Python 3.10 or 3.11 (NOT 3.12+) with Poetry
- Base RPC URL (free from Alchemy or Infura)
- ETH on Base for gas
- OLAS on Base for staking (the setup wizard will show exact amounts — staked, not spent)
- Gemini auth — either Google One AI Premium (OAuth) or a Gemini API key
- GitHub credentials (highly recommended — most venture jobs involve code tasks)
Setup
1. Clone the repo
git clone https://github.com/Jinn-Network/jinn-node.git
cd jinn-node
2. Install dependencies
corepack enable
yarn install
3. Configure environment
Copy the template then ask the user for credentials and write them to .env. Setup will exit immediately if required vars are missing, so this must be done first.
cp .env.example .env
Ask the user for these values and write them to .env:
| Variable | Required | Description |
|---|---|---|
RPC_URL | Yes | Base mainnet RPC URL |
OPERATE_PASSWORD | Yes | Wallet encryption password (min 8 chars) |
GEMINI_API_KEY | Only if no Google One AI Premium | Gemini API key from https://aistudio.google.com/apikey. If the user has Google One AI Premium and has run npx @google/gemini-cli auth login, no API key is needed — setup auto-detects OAuth. |
GITHUB_TOKEN | Highly recommended | Personal access token with repo scope |
GIT_AUTHOR_NAME | Highly recommended | Git commit author name — this becomes the identity the worker agent uses when committing code on venture jobs |
GIT_AUTHOR_EMAIL | Highly recommended | Git commit author email |
4. Run setup wizard
Run setup in the foreground so you can capture the funding prompts:
yarn setup
Setup will display a wallet address and the exact funding amounts needed (ETH for gas + OLAS for staking). Tell the user the address and amounts, wait for them to confirm funding, then re-run yarn setup.
5. Start the worker
yarn worker
For a single-job test run: yarn worker --single
Detailed Guides
- Setup (advanced): references/setup.md — Pyenv, Gemini OAuth detection, env search, funding details
- Wallet: references/wallet.md — Balances, backup, key export, withdraw, recovery
- Launchpad: references/launchpad.md — Browse ventures, suggest ideas, like, comment, propose KPIs. Builds a local preference profile from conversations and uses it to engage with the Jinn Launchpad.
Troubleshooting
| Issue | Solution | |
|---|---|---|
yarn not found | corepack enable (ships with Node 20+) | |
poetry not found | curl -sSL https://install.python-poetry.org \ | python3 - |
| Python 3.12+ errors | Install Python 3.11 via pyenv: pyenv install 3.11.9 | |
| Setup stuck | Waiting for funding — send ETH/OLAS and re-run yarn setup | |
| Gemini auth errors | Run npx @google/gemini-cli auth login |
Quick Reference
| Command | Purpose |
|---|---|
yarn setup | Initial service setup |
yarn worker | Run worker (continuous) |
yarn worker --single | Test with one job |
yarn wallet:info | Show addresses + balances |
yarn wallet:backup | Backup .operate directory |
yarn wallet:withdraw --to | Withdraw funds from Safe |
yarn wallet:recover --to | Emergency recovery (destructive) |
Need Help?
- Documentation
- Telegram Community
- Network Explorer — see your worker after setup
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制