by 安全扫描
OpenClaw
安全
high confidence该技能通过托管 OAuth 集成 Google Play Developer API，支持编程管理 Google Play Console 中的应用、订阅、内购和评论，实现自动化运营。
评估建议
该技能安全风险中等。通过托管 OAuth 与 Google Play 官方 API 交互，凭证由第三方服务器管理（Maton 网关），所有 API 流量经过 Maton 服务器。
1. OAuth 托管认证：使用 Maton 代为处理 OAuth 流程，Google 凭证不由技能本身存储
2. API 权限范围：可访问应用管理、订阅、内购、评论等数据，确保只授权必要范围
3. Maton 网关代理：所有 API 流量经过 maton.ai，流量内容对 Maton 可见
4. 托管令牌管理：OAuth 令牌由 Maton 持有，建议定期在 Maton 控制台撤销不需要的连接
使用注意：
- 确认对 Maton 服务商的信任度，它将看到 API 请求内容
- 仅授予最小必要的 Google 账户权限范围
- 定期检查 Maton 控制台的连接状态，及时撤销不需要的授权
- 在不再需要时删除技能并撤销 Google 账户授权...详细分析 ▾
✓ 用途与能力
Name/description (Google Play / Android Publisher) match the runtime instructions which call Maton endpoints (gateway.maton.ai and ctrl.maton.ai). Requesting a single MATON_API_KEY credential is coherent with a managed-OAuth gateway design.
✓ 指令范围
SKILL.md only instructs the agent to make network requests to Maton-hosted endpoints and to use the MATON_API_KEY header; there are no instructions to read unrelated files, other environment variables, or system paths, nor to send data to unexpected endpoints.
✓ 安装机制
No install spec and no code files are included (instruction-only). Nothing is written to disk or downloaded by the skill itself.
ℹ 凭证需求
The skill requires a single environment variable, MATON_API_KEY, which is appropriate for a proxy/gateway service. Note: this key is a sensitive credential granting Maton the ability to act on behalf of the user (via managed OAuth), so trusting the Maton service is necessary.
✓ 持久化与权限
The skill does not request always:true or any elevated, persistent privileges and does not modify other skill or system configurations. Autonomous invocation is allowed (platform default) but not combined with other concerning privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/5
- Added a `clawdbot` section to skill metadata, including an emoji and required environment variable (`MATON_API_KEY`). - No code or functionality changes; documentation and metadata update only.
● 无害
安装命令
点击复制官方npx clawhub@latest install google-play
镜像加速npx clawhub@latest install google-play --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Google Play — 管理应用商店 安装说明： 安装命令：npx clawhub@latest install google-play 支持国内镜像加速，使用 --registry https://cn.longxiaskill.com 参数可加速下载