by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's declared purpose (server health checks and auto-restart) matches its instructions, but the runtime guidance encourages fetching and executing remote code (npx, curl|bash) and running arbitrary restart commands — behaviors that increase risk and deserve manual review before use.
评估建议
This skill is coherent with its stated purpose, but it asks you (in SKILL.md) to fetch and run remote code (npx and a curl|bash installer) and to possibly run arbitrary restart commands. Before installing or running it: 1) Inspect the upstream repository (https://github.com/gruted/devops-ops-bot) and the install.sh script to verify what will be executed. 2) Prefer running the official Docker image or a pinned npm package version over piping a script to bash. 3) Do not run it as root; run in a co...详细分析 ▾
✓ 用途与能力
Name/description (server health monitoring, Slack/Discord alerts, auto-restart) align with the instructions and required binary (node). The examples and install targets (npm package, npx, Docker image) are coherent for a Node-based CLI monitoring tool.
⚠ 指令范围
Instructions tell the agent/user to run npx/@gruted/devops-ops-bot and provide examples that accept a --restart-cmd (arbitrary shell command). Running npx or executing a user-provided restart command gives the tool (or whoever runs it) the ability to execute arbitrary code/commands on the host; the SKILL.md does not place constraints or safeguards on those actions.
⚠ 安装机制
Install examples include npm install -g, npx usage, a Docker image (ghcr.io) and a curl -fsSL raw.githubusercontent.com | bash one-liner. While GitHub raw and ghcr.io are common hosts, piping a remote script to bash is a high-risk pattern because it executes remote code without inspection.
✓ 凭证需求
The skill declares no required environment variables or credentials. Its use of webhook URLs and restart commands is driven by CLI flags/examples rather than hidden env requests, which is proportionate to the stated functionality.
ℹ 持久化与权限
always is false and there is no install spec that modifies other skills. However, because the tool can be invoked autonomously (platform default) and can auto-restart services, autonomous runs could have significant impact if the tool or its upstream code is malicious or compromised.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install devops-ops-bot
镜像加速npx clawhub@latest install devops-ops-bot --registry https://cn.longxiaskill.com 镜像可用