by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This guide is internally inconsistent: it says it uses a sandbox with no API key, yet the skill metadata marks several sensitive environment variables as required (including a private agent signing key and a Stripe API key). Before installing or providing secrets: 1) do not supply live private keys (AGENT_SIGNING_KEY) or production Stripe keys — use test/sandbox keys only; 2) verify the publisher and source (no homepage is provided); 3) prefer keeping credentials out of skill-scoped envs if the ...详细分析 ▾
⚠ 用途与能力
The SKILL.md repeatedly states this is an educational guide that uses a GreenHelix sandbox (no API key required to get started), yet the registry metadata marks GREENHELIX_API_KEY as the primary required credential and lists WALLET_ADDRESS, AGENT_SIGNING_KEY, and STRIPE_API_KEY as required. Requiring live payment and signing credentials does not align with a read-only, example-driven guide and is disproportionate to the claimed purpose.
⚠ 指令范围
The document states it does not execute code, but its content walks the user through production concerns (payment rails, agent signing, settlement) that legitimately require secrets. Because the skill metadata declares these env vars as required, a runtime agent would receive access to them even though the guide itself should not need them. This creates scope creep: the skill's runtime access to secrets is not justified by the textual guidance.
✓ 安装机制
Instruction-only skill with no install spec and no code files. No downloads or installers are present, which minimizes disk-executed risks.
⚠ 凭证需求
Requires four environment variables including AGENT_SIGNING_KEY (a private cryptographic key) and STRIPE_API_KEY (a payment processor key). Asking for a private signing key and a live Stripe key in a guide is excessive. The SKILL.md even describes WALLET_ADDRESS as public and the sandbox as not requiring an API key, creating an inconsistency about why these secrets are mandatory.
✓ 持久化与权限
The skill is not always-on and does not request special platform-wide persistence or modifications to other skills. Autonomous invocation is allowed (default) but not in itself a new risk here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-economy-architect
镜像加速npx clawhub@latest install greenhelix-agent-economy-architect --registry https://cn.longxiaskill.com