by 安全扫描
OpenClaw
安全
medium confidenceAn instructional guide about agent contract lifecycle management that is internally consistent with its stated purpose (uses a sandbox, has no installs or credential requests), but review is recommended before allowing autonomous execution or supplying production credentials.
评估建议
This is an educational, instruction-only guide that uses the GreenHelix sandbox and does not request credentials or install software — that aligns with its stated purpose. Before you allow an agent to use this skill in production: (1) read the full SKILL.md code examples to confirm they do what you expect; (2) do NOT provide production payment/escrow credentials to the skill or to an agent running it without strict approvals; (3) require human-in-the-loop approvals for any automated penalty/escr...详细分析 ▾
✓ 用途与能力
The name/description (agent contract lifecycle, SLAs, escrow, enforcement) matches the SKILL.md content: a large educational guide with Python examples that target the GreenHelix A2A Commerce Gateway sandbox. No unrelated binaries, installs, or extraneous credentials are requested.
ℹ 指令范围
SKILL.md is instruction-only and repeatedly states examples run against the GreenHelix sandbox (no API key needed). The guide includes code examples and workflows that call an external commerce/escrow API and describe fully automated enforcement. The manifest does not show instructions to read local files or hidden env vars, but the file is large and code examples should be reviewed before allowing an agent to act autonomously or to execute those examples.
✓ 安装机制
No install spec and no code files — this is instruction-only, which minimizes disk-write/run risk. There are no downloads, package installs, or external installers declared.
ℹ 凭证需求
The skill declares no required environment variables or credentials, which is coherent with its claim to use a sandbox that needs no API key. However, many of the guide's production patterns (escrow, automated clawbacks, payment flows) would normally require sensitive credentials and financial integrations; users should not supply production secrets to this skill without additional review and safeguards.
ℹ 持久化与权限
always:false and disable-model-invocation:false (normal defaults). Although the skill does not request persistent privileges, it provides instructions for fully automated enforcement and escrow actions — if the agent is allowed to invoke skills autonomously and is given production credentials, the blast radius could be high. Consider gating autonomous execution and requiring human approval for any real-money operations.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/8
## greenhelix-agent-contract-lifecycle v1.3.1 - Documentation updated in `SKILL.md`. - No changes to code, pricing, or features. - The update is limited to doc/editorial improvements only.
● Pending
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-contract-lifecycle
镜像加速npx clawhub@latest install greenhelix-agent-contract-lifecycle --registry https://cn.longxiaskill.com