by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and resource usage align with its stated purpose (managing a MuPiBox data.json via the MuPiBox backend API); it does not request unrelated credentials or perform hidden network calls.
评估建议
This skill appears to do exactly what it says: manage a MuPiBox media DB via the MuPiBox backend. Before installing or running it, confirm you actually run (or trust) the MuPiBox service at the base URL you will provide. Be aware the script will create backups under ~/.mupibox-db-backups (ensure you have space and that you trust the backup/restore files). Because the skill can be invoked by the agent, avoid enabling it for autonomous use unless you want the agent to be able to add/edit/delete en...详细分析 ▾
✓ 用途与能力
The name/description match the bundled Python script: the script reads /api/data and posts to /api/add,/api/edit,/api/delete on a configurable base URL. No unrelated binaries, env vars, or services are requested.
ℹ 指令范围
SKILL.md and the script confine actions to the MuPiBox API and local backups. The script creates timestamped backups under the user's home (~/.mupibox-db-backups) before mutations and can restore from a user-specified file; these file operations are expected but worth noting (disk writes, potential large backup volume, and restore requires a trusted file).
✓ 安装机制
No install spec; the skill is instruction-only with a bundled Python script. Nothing is downloaded or extracted from external URLs, which minimizes install-time risk.
✓ 凭证需求
The skill requires no environment variables or credentials. It only needs network access to the MuPiBox base URL provided by the user/agent; this is proportional to its API-driven purpose.
✓ 持久化与权限
always is false and the skill does not request persistent system-wide privileges or modify other skills. It can be invoked autonomously by the agent (default), which is normal — note this allows the agent to make API mutations if triggered.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/2/14
Clarify MuPiBox API endpoint (:8200), keep --base-url override, include safety note for trusted restore files.
● 可疑
安装命令
点击复制官方npx clawhub@latest install mupibox-media-db
镜像加速npx clawhub@latest install mupibox-media-db --registry https://cn.longxiaskill.com