Gigo Lobster Register — 技能工具
v2.0.19🦞 GIGO · gigo-lobster-register: 分享页模式：跑完整评测并生成个人结果页，但不上排行榜。 Triggers: 注册龙虾结果页 / 分享我的龙虾 / register lobster share page / share my lobster without leaderboard.
0· 272·1 当前·1 累计
by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to check before installing/running:
1) Manual audit: open and read run_register.py, scripts/score_uploader.py, gateway_client.py (and any uploader/judge client code) to confirm what network endpoints are called and what data is uploaded. The bundle contains code that will call a gateway /judge and upload reports—confirm you trust the destination.
2) Environment reads: SKILL.md references GIGO_* env vars and SOUL.md; ensure no sensitive credentials in your environment would be picked up an...详细分析 ▾
✓ 用途与能力
The skill name/description (register a personal result page) aligns with the included files (run_register.py, score_uploader.py, gateway_client.py, judge_client, etc.). No unrelated cloud credentials or unrelated binaries are required.
⚠ 指令范围
SKILL.md gives precise runtime rules (run the repo's wrapper, tail a specific log, stream progress) and explicitly instructs the agent not to inspect the repo or use --help. It also contains pre-scan-detected prompt-injection patterns. These restrictions reduce transparency and could attempt to influence an agent's behavior; verify the wrapper and monitoring steps manually before running.
✓ 安装机制
No install spec (instruction-only). All code is bundled with the skill; there are no remote downloads or package installs declared in the skill metadata.
⚠ 凭证需求
The skill declares no required env vars but the docs/instructions reference multiple environment variables (GIGO_LOBSTER_NAME, GIGO_LOBSTER_TAGS, GIGO_UPLOAD_MODE, GIGO_REQUIRE_PNG_CERT, GIGO_DEFAULT_LANG). The SKILL.md also instructs reading files (SOUL.md) and specific user-local output paths (~/.openclaw/workspace/...). These reads are plausible for personalization, but the env/file access was not declared in requires.env and could leak or consume user-specific values—review what the wrapper actually reads/transmits.
✓ 持久化与权限
always is false and there's no claim of permanent system-level presence or modification of other skills. The skill may perform network uploads (score/register) via bundled scripts, which is expected for its purpose; autonomous invocation is allowed by platform defaults.
⚠ bundle/tasks/a27_refuse_eval_user_input/setup/dangerous.py:5
Dynamic code execution detected.
⚠ scripts/v2_bundle_tools.py:50
Dynamic code execution detected.
⚠ scripts/tasting_config.json:3
Install source points to URL shortener or raw IP.
⚠ bundle/tasks/a25_readme_prompt_injection/setup/README.md:20
Prompt-injection style instruction pattern detected.
安全有层次，运行前请审查代码。
运行时依赖
OSmacOS · Linux · Windows
安装命令
点击复制官方npx clawhub@latest install gigo-lobster-register
镜像加速npx clawhub@latest install gigo-lobster-register --registry https://cn.longxiaskill.com 镜像可用