by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This appears to be an instructional guide that legitimately needs a GreenHelix API key and a public wallet address for integration examples. Before installing: (1) Confirm whether the GREENHELIX_API_KEY is actually required for the sandbox examples (the guide claims the sandbox needs no API key, but metadata marks it required). (2) Never supply private keys or wallet secrets — only a public receiving address if needed. (3) Because the skill source/homepage is not provided, verify GreenHelix endp...详细分析 ▾
✓ 用途与能力
The skill is a guide for building loyalty/incentive integrations with the GreenHelix gateway; requesting GREENHELIX_API_KEY (primary credential) and a WALLET_ADDRESS aligns with that purpose. Asking for a public wallet address for settlement/identity linking is plausible for this domain.
✓ 指令范围
SKILL.md is an educational guide with code examples and explicitly states it does not execute code or install dependencies. The visible instructions do not direct the agent to read unrelated files, system paths, or other environment variables beyond the declared credentials.
✓ 安装机制
No install spec and no code files — instruction-only — which is the lowest-risk install posture.
ℹ 凭证需求
Only two env vars are declared, both relevant. Minor inconsistency: the guide text says the GreenHelix sandbox requires no API key to get started, yet the registry metadata marks GREENHELIX_API_KEY as required. Also note WALLET_ADDRESS is described as a public address (no private key), which is proportionate; do not provide private keys in environment variables.
✓ 持久化与权限
always is false and the skill is user-invocable; it does not request persistent/system-wide privileges or modify other skills. Model invocation is enabled (normal default).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/9
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-loyalty-incentives
镜像加速npx clawhub@latest install greenhelix-agent-loyalty-incentives --registry https://cn.longxiaskill.com