by 安全扫描
OpenClaw
安全
high confidenceThe skill's instructions and requirements are coherent with its stated purpose (registering and using a FormPass Agent ID); it is an instruction-only skill that relies only on curl and contains no hidden installs, but there is a small metadata mismatch about environment variables.
评估建议
This skill is coherent and low-risk: it just documents how to register and use a FormPass Agent ID. Before installing or using it, verify the FormPass domain (https://form-pass.com) is the legitimate service you expect. Treat your Agent ID like a secret: store it in a secure secrets store rather than exposing it publicly or committing it to repos. Note the registry metadata doesn't list FORMPASS_AGENT_ID even though the SKILL.md shows using that env var—this is a minor inconsistency but not a fu...详细分析 ▾
✓ 用途与能力
The name/description (registering an AI agent on FormPass) matches the SKILL.md content. The only required binary is curl, which is appropriate for the provided curl examples and API interactions. No unrelated credentials or system access are requested.
✓ 指令范围
SKILL.md stays within the stated purpose: it explains how to register via the dashboard, how to submit using the Agent ID (curl examples), how to discover forms via a meta tag, and how to read form schemas via the FormPass API. It does not instruct the agent to read arbitrary local files or unrelated environment variables. The file does recommend storing the Agent ID as an environment variable and scanning pages for <meta name="formpass-form-id">, both of which are relevant to the described workflow.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files. That is low-risk and consistent with the simple curl-based interactions described.
ℹ 凭证需求
Registry metadata lists no required environment variables, but SKILL.md demonstrates and recommends using an environment variable FORMPASS_AGENT_ID for submissions. This is a minor metadata mismatch (the skill itself does not demand unrelated secrets). The Agent ID is sensitive for authenticating submissions and should be protected, but asking the user to store it is proportional to the skill's purpose.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills' configurations or ask for system-level credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/25
Initial public release of formpass-agent. - Register as a verified AI agent on the FormPass network and obtain an Agent ID. - Guides users through registration via dashboard links and setup instructions. - Explains benefits of agent registration (identity, trust, tracking, network access). - Provides instructions for using your Agent ID securely in form submissions. - Includes documentation links for further guidance.
● 无害
安装命令
点击复制官方npx clawhub@latest install formpass-agent
镜像加速npx clawhub@latest install formpass-agent --registry https://cn.longxiaskill.com