by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill's purpose (reading Apple Contacts via osascript) is plausible, but the package as published contains only SKILL.md and no scripts. Before installing: (1) do not install or enable the skill unless the package includes the referenced scripts/contacts.applescript files — ask the publisher for the missing files or a verified release. (2) If you obtain the scripts, inspect their contents before running to ensure they only access local Contacts and do not transmit data elsewhere. (3) Be awa...详细分析 ▾
⚠ 用途与能力
The stated purpose (querying macOS Contacts via AppleScript) is coherent with using osascript, but the SKILL.md requires a scripts/contacts.applescript under the skill directory. The package manifest contains only SKILL.md and no scripts or code files, so the skill as published cannot perform the claimed functionality without additional files not present in the package.
ℹ 指令范围
Instructions are narrowly scoped to running osascript against a local AppleScript to read Contacts. That behavior legitimately requires macOS Contacts permission and will access sensitive personal data (all address-book entries). The instructions do not ask to read unrelated files or exfiltrate data, but they do direct the agent to access local contacts — a privacy-sensitive action that should be explicit to users.
⚠ 安装机制
There is no install spec (instruction-only), which is low-risk in general. However the SKILL.md's 'ensure scripts/ directory is intact' requirement is inconsistent with the manifest's lack of any scripts. Either required script files were omitted from the package or SKILL.md is stale; both are problematic because the skill will fail or depend on out-of-band downloads.
✓ 凭证需求
No environment variables, credentials, or config paths are requested — appropriate for a local Contacts lookup. Note that the skill will request macOS Contacts permission at runtime, which grants access to the user's address book (sensitive personal data).
✓ 持久化与权限
always is false and autonomous invocation is allowed (platform default). There is no evidence the skill requests permanent presence or modifies other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/17
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install macos-contacts
镜像加速npx clawhub@latest install macos-contacts --registry https://cn.longxiaskill.com