by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements and runtime instructions are coherent with its stated purpose (reading tapes' token counts and reporting heartbeats to ingest.claw.tech); nothing requested appears unrelated, though you should audit any remote install scripts and the clawtel binary before trusting them.
评估建议
This skill appears internally consistent with its purpose, but exercise normal caution before installing remote binaries. Prefer the verified install path (download the release tarball from GitHub and validate checksums) rather than piping curl to bash. Inspect the installer script at raw.githubusercontent.com and the clawtel GitHub repo or build from source if you need maximum assurance. Treat CLAW_INGEST_KEY as a secret: only provide it to hosts you trust. If you are concerned about sending an...详细分析 ▾
✓ 用途与能力
The skill is a setup guide for clawtel telemetry: it requires the 'tapes' binary and two claw-specific env vars (CLAW_INGEST_KEY, CLAW_ID) which match the described function of reading tapes' token counters and sending heartbeats to ingest.claw.tech.
ℹ 指令范围
SKILL.md instructs reading the local tapes SQLite DB (~/.tapes/tapes.sqlite), editing OpenClaw config (~/.openclaw/openclaw.json) for wiring, running system commands (ss, pgrep, sqlite3) and configuring persistent services. These actions align with setup/verification but do involve reading local process and file state; the instructions claim only metadata (timestamps, model, token counts) will be sent, which is consistent but relies on trusting the clawtel binary.
ℹ 安装机制
The skill is instruction-only (no install spec), and recommends installing clawtel either by pinned GitHub release with checksum verification (good) or via a convenience curl|bash install script (convenient but higher risk). It also points to a third-party 'tapes' install script (download.tapes.dev). These are common patterns but involve downloading and executing remote code; prefer pinned releases + checksum verification or auditing the install scripts beforehand.
✓ 凭证需求
Required env vars (CLAW_INGEST_KEY and CLAW_ID) are proportional to the stated purpose (authenticating ingestion to claw.tech). No unrelated secrets or broad cloud credentials are requested.
✓ 持久化与权限
The skill does not request always:true and is user-invocable. It suggests running clawtel as a persistent service (reasonable for telemetry), but does not request elevated or cross-skill privileges in the metadata.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/4/20
clawtel-setup 1.2.0 - Added detailed, verified install instructions with release checksums for improved security and reproducibility (Option A), alongside the original one-liner. - Expanded the "metadata" section for OpenClaw, now defining primary env vars, emoji, and homepage. - Clarified verification steps so users can check if their install matches the intended release. - No code or file changes; this update is documentation-only, improving reliability and user onboarding.
● 可疑
安装命令
点击复制官方npx clawhub@latest install clawtel-setup
镜像加速npx clawhub@latest install clawtel-setup --registry https://cn.longxiaskill.com