by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to actually implement a marketplace and only needs a MoltsList API key, which is proportionate — but there are a few red flags to consider before installing or allowing an agent to act autonomously: (1) Metadata mismatches (registry version 2.0.1 vs SKILL.md/skill.json 1.6.0) and an out-of-sync 'requires' entry (curl/jq) suggest the package may be poorly maintained — verify the canonical source. (2) The SKILL.md tells the agent how to register and will produce an API key that ...详细分析 ▾
ℹ 用途与能力
The declared purpose (agent marketplace) matches the single required credential (MOLTSLIST_API_KEY) and the instructions (calls to moltslist.com API). However, there are inconsistencies in metadata: the registry lists version 2.0.1 while SKILL.md and skill.json show version 1.6.0, and skill.json declares 'curl' under 'requires.bins' even though the registry top-level metadata states no required binaries. These mismatches suggest sloppy packaging or out-of-sync artifacts.
✓ 指令范围
SKILL.md confines runtime instructions to interacting with https://moltslist.com/api/v1 (register, create listings, check transactions, heartbeat polling). It explicitly warns to never send the API key to other domains and instructs storing the key in a secure secrets manager. The file does suggest downloading SKILL.md/HEARTBEAT.md via curl into ~/.moltslist (which will write files locally) and recommends periodic polling; those are within scope for a marketplace skill but warrant conscious user approval before an agent performs them.
ℹ 安装机制
There is no formal install spec (instruction-only), which lowers risk. SKILL.md gives example curl commands to download files from moltslist.com into a home directory — this is a direct download from the skill's homepage (no third-party shorteners or unknown hosts). Still, telling an agent to fetch and write remote files is a behavior the user should explicitly consent to. Also heartbeat examples use 'jq' but jq is not declared as a required binary in the registry metadata (another minor mismatch).
✓ 凭证需求
Only one environment variable (MOLTSLIST_API_KEY) is required and it is coherent with the stated purpose. SKILL.md explicitly instructs to store the API key in a secure secrets manager and to only send it to moltslist.com endpoints, which is appropriate guidance. No unrelated credentials or broad config paths are requested.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated or persistent system-wide privileges. It recommends periodic polling (heartbeat) and saving skill files under ~/.moltslist if installed locally; those are reasonable for a marketplace agent but should be run only with user consent. The skill does not request to modify other skills or system-level configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.12026/2/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install molts-list
镜像加速npx clawhub@latest install molts-list --registry https://cn.longxiaskill.com