by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to honestly provide FEMA/NOAA/USGS data, but installing it requires adding a third-party MCP server (natural-disaster-intel-mcp.apify.actor) to your OpenClaw MCP config. Before you install: 1) Verify the GitHub homepage and the operator running the Apify actor; inspect the server's source code if available. 2) Back up and inspect your existing ~/.openclaw/mcp.json after running mcporter (or edit it manually) so you know what changed. 3) Be aware that the remote server can stre...详细分析 ▾
ℹ 用途与能力
Name/description (FEMA/NOAA/USGS) match the SKILL.md which exposes three disaster-monitoring tools. The requirement for the 'mcporter' binary is consistent with adding an MCP server. However, the runtime instructions recommend writing to ~/.openclaw/mcp.json (agent config) while the skill metadata lists no required config paths — a small mismatch that should be declared.
⚠ 指令范围
The SKILL.md instructs the agent/user to add a remote MCP server URL (https://natural-disaster-intel-mcp.apify.actor/mcp) using mcporter or by editing ~/.openclaw/mcp.json. That action connects the agent to an external host which can stream tool interfaces and data; instructions do not request unrelated local data, but they do modify the agent's MCP config (a privileged configuration surface). The doc does not describe what the remote server will publish beyond the three tools.
✓ 安装机制
There is no install spec and no code files — lowest-risk deployment surface. The single binary dependency (mcporter) is reasonable for adding an MCP server. No downloads/archives or opaque install URLs are provided by the skill itself.
ℹ 凭证需求
The skill requests no environment variables or credentials, which is proportional. However, it implicitly requires write access to the user's MCP config (~/.openclaw/mcp.json) via mcporter or manual edit; that config-path requirement is not listed in the metadata and should be declared.
⚠ 持久化与权限
always is false (good) and autonomous invocation is allowed (platform default). The actionable concern is that adding the remote MCP server persists a reference in the agent config so the external host can supply/stream tools later — this increases the blast radius of the remote service and should be trusted only if the server/operator is verified.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/27
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install gov-disaster-intel
镜像加速npx clawhub@latest install gov-disaster-intel --registry https://cn.longxiaskill.com