by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions mostly match its stated purpose, but it instructs the agent to create persistent skill files under ~/.openclaw/skills/ and to handle credentials without declaring or constraining that access — this mismatch and lack of guidance for secret handling are concerning.
评估建议
This skill appears to do what it says (research and wire up external platforms), but there are important cautions:
- The SKILL.md tells the agent to create new skill files under your home (~/.openclaw/skills/). The registry metadata did not declare this config path — expect the agent to write files to your filesystem if you accept creation.
- The skill will want to obtain and use platform credentials (API keys, OAuth tokens, SSH keys) and run initial API calls. Ask the skill how it will store a...详细分析 ▾
ℹ 用途与能力
The skill's name/description (finding and wiring external platform access via plugin/CLI/API) matches the runtime instructions (research, present options, implement chosen approach). However the SKILL.md explicitly instructs creating new skill directories under ~/.openclaw/skills/ (persistence/config write) while the registry metadata lists no required config paths — that discrepancy is an incoherence to be aware of.
⚠ 指令范围
Instructions direct the agent to research platforms, install/configure CLIs or plugins, write API-calling scripts, and perform first-call tests. They also mandate asking the user whether to 'create a skill' and, if requested, to write files in ~/.openclaw/skills/ including a SKILL.md. The doc gives no guidance on how credentials should be obtained, used, or stored securely, and does not restrict what the created SKILL.md may contain (risk of persisting secrets or sensitive configuration).
✓ 安装机制
No install spec and no code files — this is instruction-only, which is the lowest install risk. The skill does not pull code or binaries itself.
⚠ 凭证需求
The registry lists no required environment variables or config paths, but runtime behavior implies obtaining and using platform credentials (API keys, OAuth tokens, SSH keys) and possibly writing configuration into ~/.openclaw/skills/. Requesting or persisting secrets is reasonable for the task, but the absence of declared config paths and lack of secure-handling guidance is disproportionate and ambiguous.
⚠ 持久化与权限
The skill explicitly instructs writing new skill directories and SKILL.md files into ~/.openclaw/skills/, which modifies the agent's skill set/persistence. Although creating skills is within the realm of its purpose, this action is not declared in metadata and, combined with the agent's ability to run API tests with credentials, increases risk (new skill code could be introduced to the agent environment).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/3
Initial release of link-all: a skill for connecting and managing external platforms. - Guides users to link, access, authorize, and manage external platforms. - Researches target platforms and collects official documentation for APIs, CLI tools, or plugins. - Suggests linking solutions in order: OpenClaw plugin > CLI tool > API scripting. - Sends found options to users for confirmation before executing. - Assists with configuration, scripting, and first-time connection testing. - After successful linking, prompts users to optionally save the solution as a new skill for reuse. - Provides standardized output templates for reports and conversations.
● 可疑
安装命令
点击复制官方npx clawhub@latest install link-all
镜像加速npx clawhub@latest install link-all --registry https://cn.longxiaskill.com