by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill does what it says (connects to Huawei devices over SSH and runs inspection commands), but it includes hard-coded device IPs and plaintext credentials inside SKILL.md. Do NOT run it as-is on your network. Before installing: - Treat the listed IPs/credentials as potentially sensitive and either remove them or confirm they are safe test accounts. - Replace embedded credentials with user-supplied secrets (environment variables, secure prompt, or secret store) and declare them in the skill...详细分析 ▾
ℹ 用途与能力
The name/description (Huawei device SSH inspection) aligns with the instructions to SSH and run display commands. However, the SKILL.md embeds concrete device IPs and plaintext credentials instead of asking the user to provide or store credentials securely; that is unexpected for a reusable skill.
⚠ 指令范围
The instructions tell the agent to spawn interactive SSH sessions via pexpect and run many device commands (expected). But they also include hard-coded management addresses and passwords, and advise disabling host key checking (-o StrictHostKeyChecking=no). The instructions do not specify how credentials should be supplied, validated, or limited, and they would cause the agent to connect to specific hosts automatically if run as-is.
✓ 安装机制
This is an instruction-only skill with no install spec; it lists reasonable runtime dependencies (Python3 + pexpect, optional sshpass). No downloads or archive extracts are present.
⚠ 凭证需求
requires.env is empty but the SKILL.md contains plaintext usernames and passwords and specific management IPs. The skill requests no declared secrets while expecting access to device credentials — that mismatch is disproportionate and increases risk (hard-coded secrets, unclear secret sourcing).
✓ 持久化与权限
The skill is not always-enabled and has no install-time persistence. It does not request system-wide configuration changes or elevated platform privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/21
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install huawei-device-inspector
镜像加速npx clawhub@latest install huawei-device-inspector --registry https://cn.longxiaskill.com