by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- Functionality: The skill actually implements NEAR RPC calls and runs the NEAR CLI (via shell exec), which fits its stated purpose.
- Missing declarations: The registry metadata does not list required binaries, but you need Node.js and the NEAR CLI installed and configured locally. Expect it to use your NEAR CLI keys/signers when performing registrations.
- Review & test: Inspect the included script (scripts/nameservice.js) yourself (it’s short) and test on t...详细分析 ▾
ℹ 用途与能力
The skill's name, description, SKILL.md, and scripts all implement NEAR Name Service operations (RPC queries and invoking near CLI). However the registry metadata declares no required binaries or env vars while the README and SKILL.md explicitly expect NEAR CLI and Node to be present — this mismatch is unexpected and should have been declared.
✓ 指令范围
Runtime instructions only use NEAR RPC and the NEAR CLI to query and register names. The SKILL.md does not instruct reading unrelated files or sending data to external endpoints outside NEAR RPC/CLI. The code does execute shell commands (near call), which is expected for this purpose.
⚠ 安装机制
There is no install spec despite a Node script and package.json being present. The skill will require a Node runtime and NEAR CLI on the host to function; neither are declared in the skill metadata. Lack of an install or declared runtime is a delivery/compatibility omission and increases risk of surprises at runtime.
ℹ 凭证需求
The skill declares no required env vars, but SKILL.md recommends setting NEAR_ACCOUNT and the script reads process.env.NEAR_ACCOUNT. Registration uses the local NEAR CLI signer (local keys) implicitly. These are proportional to the task, but the skill does not declare or explain the need for NEAR CLI-managed credentials or how keys/signers are used.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/8
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install near-name-service
镜像加速npx clawhub@latest install near-name-service --registry https://cn.longxiaskill.com