by 安全扫描
OpenClaw
安全
medium confidenceThe skill is an instruction-only revenue-analytics guide for the GreenHelix gateway; its single required credential (GREENHELIX_API_KEY) is reasonable for live API integration, though there is a minor inconsistency about sandbox usage and whether a key is actually required.
评估建议
This skill is an instructional guide and looks coherent for revenue analytics using GreenHelix. Before installing or enabling it: (1) prefer using the GreenHelix sandbox examples without providing any live API key; (2) if you supply GREENHELIX_API_KEY for live calls, ensure the key is scoped/minimal (read-only if possible), rotated, and logged; (3) review the Python examples in full before running them—confirm they only call GreenHelix endpoints you expect and do not exfiltrate local files or ot...详细分析 ▾
✓ 用途与能力
The name and description claim a revenue-analytics guide for GreenHelix. Requiring a GreenHelix API key is consistent with examples that perform live API integration and access billing/payment/marketplace data. Nothing in the manifest requests unrelated cloud credentials, binaries, or config paths.
ℹ 指令范围
SKILL.md is a long, instructional guide with Python examples and API integration. The doc explicitly states examples use the GreenHelix sandbox and 'does not execute code or install dependencies.' It also asks users to supply GREENHELIX_API_KEY for live interactions. There is no evidence in the provided excerpt that the instructions ask the agent to read unrelated local files or other environment variables, but the full content is large and truncated — verify code examples before running them against live keys.
✓ 安装机制
No install spec and no code files (instruction-only). This is the lowest-risk install mechanism: nothing will be written to disk by the skill itself.
ℹ 凭证需求
Only one environment variable (GREENHELIX_API_KEY) is declared as required, which is proportionate for a guide that demonstrates full API integration. However, the SKILL.md also claims the GreenHelix sandbox provides free credits and 'no API key required to get started' — this conflicts with the manifest's required-env declaration. Also note the manifest describes the key as granting 'read/write access to purchased API tools'; if you supply a live key, prefer a scoped/limited key (read-only) when possible.
✓ 持久化与权限
always is false and the skill is user-invocable (normal). The skill does not request system-level persistence or modification of other skills' configuration.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/9
- Added OpenClaw-specific metadata block, specifying required environment variables (GREENHELIX_API_KEY) and primary credential. - Clarified integration requirements for improved compatibility and deployment on OpenClaw.
● Pending
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-revenue-analytics
镜像加速npx clawhub@latest install greenhelix-agent-revenue-analytics --registry https://cn.longxiaskill.com