by 安全扫描
OpenClaw
可疑
medium confidenceThe skill largely matches its investment‑pet description, but it includes executable scripts that read/write local data, an ingest/self‑evolution pipeline, and 'viral/growth' and publish instructions — all of which warrant manual review before enabling Exec/Read/Write privileges.
评估建议
This skill appears coherent with its stated goal, but it exercises broad local privileges (running Python scripts, reading/writing user data, ingesting conversation logs, and contains growth/publish tooling). Before installing or enabling Exec/Read/Write for the agent: 1) Review scripts that can access network (viral_growth.py, sync_manager.py, feedback_collector.py, master_summon/data_layer) for any outbound calls or credential use. 2) Verify the ingest/lint routines only write to local storage...详细分析 ▾
✓ 用途与能力
Name/description (investment companion, pet personalities, compliance) align with the included files: pets/*.json, personality/test/match scripts, heartbeat engine, compliance checker, and knowledge/wiki docs. The presence of many docs and scripts is proportionate to a stateful, locally-run companion skill.
⚠ 指令范围
SKILL.md instructs agents to run local Python scripts, read/write pets/, templates/, raw/ and wiki/ files, and to 'Ingest' raw interactions into a wiki (create/update pages and log changes). That implies the agent will process and persist user conversation records and other local files; this is within the stated scope but is privacy‑sensitive and broad. The docs also include steps to publish to GitHub/ClawHub/Vercel — those instructions require credentials if executed, and could cause network interactions if followed. The SKILL.md contains 'self-evolution' ingest behavior which can modify repository/wiki files; ensure this is limited to local storage and explicit user consent is required.
✓ 安装机制
No external download/install spec is present; the package is delivered as code files. There are no installer URLs or extract steps flagged. Risk here comes from the code itself (it will be copied to disk on install), not from an external installer.
ℹ 凭证需求
The skill declares no required environment variables or external credentials. However, its documentation and publish guides reference GitHub/ClawHub/Vercel tokens and local data_layer paths. While these are reasonable for development/publishing, any action that pushes/references remote endpoints would require credentials — review scripts that might attempt network access (e.g., viral_growth.py, sync_manager.py, master_summon/data_layer calls) before granting network or credential access.
⚠ 持久化与权限
allowed-tools include Exec, Read, Write and the skill's runtime docs instruct running scripts that write/modify wiki and user data (log.md, wiki pages, data/users/**). 'always' is false, but allowing Exec+Write grants a skill substantial local privileges. Confirm that 'never_store_user_data_cloud' and local-only constraints are enforced in code and that scripts do not perform unintended remote syncs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.42026/4/13
investment-buddy-pet v1.2.1 - 合规增强：跨技能调用“大师”前，必须获取用户明确同意，并告知建议为参考性质，最终建议需标明“仅供参考，非投资决策”。 - 移除 self_improvement 字段，满足 ClawHub 安全扫描要求。 - 更新与“召唤大师”相关流程、话术和错误处理示例，确保用户安全和主动知情。 - 更新 tags 字段，删除“自我进化”。 - 其他文档小幅调整，明确交互边界和流程细节。
● Pending
安装命令
点击复制官方npx clawhub@latest install investment-buddy-pet
镜像加速npx clawhub@latest install investment-buddy-pet --registry https://cn.longxiaskill.com