by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do only what it says: locally hash data and POST the hash to api.mpps.io for a signed receipt. Before installing, consider: (1) Do you want your agent to be able to send hashes to an external service automatically? If not, disable autonomous invocation or require user confirmation. (2) Never hash short or low-entropy secrets directly — salt or include additional context to avoid leakability. (3) Verify the service (https://mpps.io and the referenced GitHub repo) and its TLS...详细分析 ▾
✓ 用途与能力
The name/description match the instructions: compute a SHA-256 hash locally and POST it to api.mpps.io. No credentials, installs, or unrelated capabilities are requested. The SKILL.md notes curl or any HTTP client is required; the registry metadata did not list curl as required but the skill provides both bash and python examples, so this is proportionate.
ℹ 指令范围
Instructions only compute a local hash and send it to api.mpps.io; they do not direct the agent to read unrelated files or secrets. However, hashing small or predictable secrets can leak identifiable information—SKILL.md warns to avoid hashing short secrets or to salt them. Users should ensure the agent won’t automatically attest sensitive plaintext without salting or user consent.
✓ 安装机制
No install spec or code files — instruction-only skill. Lowest-risk distribution model (no downloads or executables written to disk).
✓ 凭证需求
The skill requests no environment variables, credentials, or config paths. This is proportionate to its described network-only notarization function.
ℹ 持久化与权限
always:false and default autonomy settings means the agent can call the service autonomously (normal for skills). Consider whether you want the agent to be allowed to send attestations automatically, since network calls will transmit hashes to an external service.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.02026/3/20
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install mpps-attestation
镜像加速npx clawhub@latest install mpps-attestation --registry https://cn.longxiaskill.com