by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This appears to be an educational guide that expects you to wire your own GreenHelix API key, Redis URL, and a wallet address. Before installing or supplying secrets: (1) Confirm why GREENHELIX_API_KEY is required despite the guide's 'no API key required' sandbox claim; (2) Never provide private keys or wallet private material—only a public address if truly needed; (3) Use a private/secured Redis instance (avoid exposing REDIS_URL to the public); (4) Review the included Python examples yourself ...详细分析 ▾
ℹ 用途与能力
The declared requirements (GREENHELIX_API_KEY, REDIS_URL, WALLET_ADDRESS) align with a guide that integrates a commerce gateway and a Redis-backed memory tier. However the SKILL.md text explicitly states the GreenHelix sandbox 'provides 500 free credits — no API key required to get started' while metadata/credentials still require GREENHELIX_API_KEY; this is an inconsistency that should be clarified.
✓ 指令范围
This is an instruction-only guide containing production-ready Python examples for memory, reconciliation, and payment flows. The instructions (as shown) reference only the declared env vars and the GreenHelix API; they do not instruct reading unrelated system files or hidden credentials. Still, 'production-ready code' examples that interact with payment systems and persistent storage should be reviewed for data-handling and security details before execution.
✓ 安装机制
No install spec and no code files are included (instruction-only). That minimizes installation risk — nothing will be downloaded or written by the skill itself.
ℹ 凭证需求
The number and type of env vars requested is reasonable for the stated purpose: API key for GreenHelix, REDIS_URL for state persistence, and WALLET_ADDRESS for payment routing. Concerns: (1) the guide's claim that the sandbox requires no API key conflicts with requiring GREENHELIX_API_KEY in metadata; (2) ensure WALLET_ADDRESS is truly only a public address and not a placeholder that could encourage providing private keys or secrets.
✓ 持久化与权限
The skill does not request always:true, has no install actions, and does not modify other skills or system settings. Autonomous invocation is allowed by default but not a new privilege introduced here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/9
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-memory-commerce
镜像加速npx clawhub@latest install greenhelix-agent-memory-commerce --registry https://cn.longxiaskill.com