📦 lex — 构建Warden智能体
v1.0.0基于 LangGraph 为 Warden Protocol 打造原创智能体，并一键发布至 Warden Studio，支持链上激励与自定义部署。
0· 1.6k·2 当前·2 累计
by @kulotzkih下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to actually be a Warden/LangGraph agent builder (templates, docs, init/test scripts) but the registry metadata is inconsistent and provenance is unclear — proceed cautiously. Before installing or running it: 1) Verify the source/owner (why is the registry name 'lex' but SKILL.md calls it 'warden-agent-builder'?) and prefer an official repo or published release. 2) Inspect the two Python scripts (init-agent.py and test-agent.py) yourself; they scaffold files into the current ...详细分析 ▾
ℹ 用途与能力
The skill's runtime instructions, README, scripts, and reference docs are coherent with the claimed purpose of scaffolding and deploying LangGraph Warden agents (templates for TypeScript/Python, deployment guides, test script). However the registry metadata (skill name 'lex', no required env vars, no homepage/source) does not match the SKILL.md frontmatter/name ('warden-agent-builder') and the content expects API keys (OPENAI_API_KEY, LANGSMITH_API_KEY). That mismatch is disproportionate to the stated purpose and reduces trust.
✓ 指令范围
SKILL.md and reference files instruct the agent to read docs, clone a community repo for study, create a project via provided init script, install typical dependencies, and run a test script against an agent endpoint. The instructions do not ask the agent to read unrelated system files or exfiltrate secrets. They do instruct to create .env files and to supply API keys (OpenAI, LangSmith, and optional third-party API keys) which is expected for this functionality.
✓ 安装机制
There is no install spec (instruction-only), and included scripts are local files. No downloads from untrusted URLs or archive extraction are present in the skill package. This is low-risk from an install mechanism perspective, though executing the bundled scripts will write files into the runtime filesystem (scaffolding projects).
⚠ 凭证需求
The skill package and SKILL.md clearly require secrets (OPENAI_API_KEY and LANGSMITH_API_KEY at minimum) and hint at other API keys (COINGECKO_API_KEY, ALCHEMY_API_KEY, WEATHER_API_KEY). Yet the registry metadata reports no required env vars and no primary credential. That inconsistency is problematic: the skill will expect and instruct users to handle secrets but the advertised requirements do not declare them. No unrelated credentials (e.g., cloud provider keys) are requested, which is appropriate for the stated purpose.
✓ 持久化与权限
The skill does not request always:true and does not claim to modify other skills or system-wide settings. It will be invoked when triggered and can execute included helper scripts; that level of privilege is expected for a scaffolding/deployment helper. Nothing suggests it persistently elevates its privileges or silently enables itself across agents.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/3
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install lex
镜像加速npx clawhub@latest install lex --registry https://cn.longxiaskill.com