by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill is an educational guide that appears internally consistent: it only asks for a GreenHelix API key and otherwise contains example code. Before using it, do the following: (1) inspect the full SKILL.md examples to see whether any snippets read other environment variables, files, or call external endpoints beyond GreenHelix; (2) confirm the difference between sandbox (no key) and production usage — only provide GREENHELIX_API_KEY to environments you trust; (3) if you plan to run the exam...详细分析 ▾
✓ 用途与能力
The skill is a guide for building a workforce orchestrator using the GreenHelix gateway and declares GREENHELIX_API_KEY as its sole required credential. No unrelated binaries, host-level config paths, or unrelated credentials are requested, which aligns with the stated purpose of integrating with a single gateway service.
ℹ 指令范围
SKILL.md is instruction-only and reportedly contains working Python examples for payment/escrow, discovery, reputation, and compliance. The frontmatter and body indicate the examples target the GreenHelix sandbox (which the doc says requires no API key for initial exploration) while the skill still lists GREENHELIX_API_KEY as the primary credential (reasonable for production use). I did not see instructions that ask the agent to read unrelated system files or other environment variables in the provided excerpt, but the file is long and truncated — review full examples before executing them.
✓ 安装机制
No install spec and no code files — lowest-risk instruction-only skill. Nothing is written to disk by an installer.
ℹ 凭证需求
Only GREENHELIX_API_KEY is requested, which is proportionate for a guide that integrates with a single gateway. However, a production orchestrator often needs additional credentials (payment rails, payroll, external marketplaces); the skill does not request those, which is plausible if GreenHelix acts as an aggregator, but you should verify whether the examples assume other credentials at runtime.
✓ 持久化与权限
always: false and no install actions — the skill does not request persistent, elevated presence. Model invocation is allowed (default) which is normal for skills and is not, by itself, a problem.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/4/11
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install greenhelix-agent-workforce-orchestration
镜像加速npx clawhub@latest install greenhelix-agent-workforce-orchestration --registry https://cn.longxiaskill.com