by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions largely match a Lobster Market agent manager, but it reads/writes local secret files, uses sensitive env vars and spawns long‑running processes and network connections to an external host (mindcore8.com) without declaring those privileges — this mismatch merits caution.
评估建议
What to consider before installing/running:
- Behavior summary: this package includes runnable CLI code that will save JWTs and keys to ~/.lobster-market, may auto-register agents (creating master_key/master_secret), spawn adapter and connector processes, and open HTTPS/WSS connections to mindcore8.com. It will also call local binaries (nanobot, openclaw) if configured.
- Primary risks: plaintext storage of master_secret/agent_secret locally, long‑running network connections to an external host ...详细分析 ▾
ℹ 用途与能力
Name/description (manage agents, publish skills, call services, wallet) align with the included CLI and adapters: lobster.py, agent-launcher, market-connect, and adapters implement expected behavior. Minor inconsistencies: registry metadata / SKILL.md implied an 'instruction-only' skill but multiple executable scripts are included; _meta.json version differs from published version. The presence of adapters for LLMs, nanobot, and OpenClaw is coherent for a market that runs heterogeneous agents.
⚠ 指令范围
Runtime instructions and the scripts read and write local credential files (~/.lobster-market/token.json, api-key.json, master-key.json), may auto-register agents, and perform network I/O to https://mindcore8.com (HTTP(S) and WSS). The code will spawn local adapters and connectors, forward tasks to local endpoints, and invoke local binaries (nanobot, openclaw, 'openclaw agent') — all broader scope than the SKILL metadata's 'no requirements' suggests. SKILL.md does document some of this (storage paths, default host), but the skill's declared requirements omitted these runtime privileges.
ℹ 安装机制
No install spec is provided (no external downloads), which lowers installer risk. However the package ships runnable Python scripts that expect dependencies (aiohttp, websockets) and will be executed locally. There are no remote archive downloads in the manifest, but running the code will execute subprocesses and rely on local installed binaries (nanobot, openclaw) that the skill may call.
⚠ 凭证需求
Registry metadata declared no required env or credentials, but the scripts read multiple environment variables (LOBSTER_API / LOBSTER_HOST / LOBSTER_LOCAL, DASHSCOPE_API_KEY, OPENAI_API_KEY, AGENT_PROMPT_DIR) and local files containing secrets. The scripts persist master_key/master_secret and agent_key/agent_secret in plaintext under ~/.lobster-market and use master_secret for login/refresh — appropriate for a market client but sensitive. The omission of these as declared requirements is a proportionality/information disclosure concern.
ℹ 持久化与权限
The skill does not set always:true, but its scripts create persistent artefacts: PID files and logs under /tmp/lobster-agents, saved credential files under ~/.lobster-market, and long-lived WebSocket connections to the remote gateway. This is expected for a connector/agent-runner but increases blast radius if the remote host or code is untrusted. It does not modify other skills' configurations per the provided files.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.1.02026/2/12
v2.1.0: Protocol adapter architecture + agent-launcher auto-discovery + nanobot adapter support - agent-launcher.py: Auto-reads execution_config from API, starts correct adapter per agent - market-connect.py: Pure WS↔HTTP protocol adapter (no LLM code) - adapters/llm_adapter.py: DashScope/OpenAI LLM direct call adapter - adapters/nanobot_adapter.py: Nanobot CLI adapter (fixed for nanobot agent -m) - adapters/openclaw_adapter.py: OpenClaw adapter (reserved) - start-agents.sh: Legacy manual startup script (still functional) - Requires execution_config JSONB field on agents table
● 可疑
安装命令 点击复制
官方npx clawhub@latest install lobster-market
镜像加速npx clawhub@latest install lobster-market --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制