by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill appears to implement the described Mistral multi-agent orchestrator, but the included Python code will also call ElevenLabs and Tavily if corresponding API keys are present and exposes FastAPI endpoints — none of which are fully declared in the skill metadata. Before installing: 1) Inspect the code (you already have it); confirm you trust the external services (ElevenLabs, Tavily) and the exact endpoints used. 2) Decide whether you want to provide ELEVENLABS_API_KEY and TAVILY_API_KEY...详细分析 ▾
ℹ 用途与能力
Name/description focus on Mistral Agents API and multi-agent orchestration which matches most of the code. However, the code also integrates ElevenLabs (TTS/SFX/music) and Tavily (web search) — these cross-service tool integrations are not declared in the registry requires.env or in the SKILL.md's 'network' justification (which only mentions api.mistral.ai). Requesting only MISTRAL_API_KEY in metadata is incomplete given the code.
⚠ 指令范围
SKILL.md instructs using Mistral's Agents and Conversations APIs (coherent). The shipped Python implements an APIRouter (FastAPI) exposing endpoints (/api/agent/chat, /api/orchestrate) and performs outbound calls to ElevenLabs and Tavily. The SKILL.md does not clearly state the runtime exposes HTTP endpoints or that it will call external services beyond Mistral, giving the agent broad discretion not described in the manifest.
✓ 安装机制
No install spec (instruction-only) is present; the skill includes source files but does not declare downloads or extracted archives. This is lower installation risk in terms of fetching arbitrary binaries.
⚠ 凭证需求
Registry metadata requires only MISTRAL_API_KEY, but the code reads ELEVENLABS_API_KEY and TAVILY_API_KEY and will call those services if present. Those additional credentials are not declared as required or optional in the skill metadata, which is disproportionate and opaque.
ℹ 持久化与权限
always is false and the skill does not request system config paths. However, the code can create agents on the Mistral platform and expose HTTP endpoints — this grants the skill persistent network interactions and the ability to perform API actions when MISTRAL_API_KEY (and optionally other keys) are present. Autonomous invocation is allowed (platform default) and increases blast radius if extra keys are provided.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/7
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install mistral-agents-orchestrator
镜像加速npx clawhub@latest install mistral-agents-orchestrator --registry https://cn.longxiaskill.com