💚 Neon — 无服务器Postgres
v1.0.0基于Neon API的无服务器Postgres平台，一键管理项目、分支、数据库、角色、端点及计算资源。为开发快速创建数据库分支，实现高效测试与协作。
0· 323·3 当前·3 累计
by @aiwithabidi 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill largely does what it says — it calls Neon API endpoints and requires NEON_API_KEY. Before installing, consider:
- Provide NEON_API_KEY explicitly in the agent environment rather than relying on a workspace .env file. The script will attempt to read WORKSPACE/.env or ~/.openclaw/workspace/.env to find the key if the env var is absent. If that file contains other secrets, decide whether you want the skill to be able to read it.
- SKILL.md does not disclose that it reads a .env file or...详细分析 ▾
✓ 用途与能力
Name, description, and implemented operations align: the script makes HTTP calls to Neon API endpoints and exposes project/branch/database/role/endpoint/consumption operations. Requiring NEON_API_KEY is appropriate for this purpose.
⚠ 指令范围
SKILL.md claims 'never stores data locally' and declares only NEON_API_KEY, but the script's get_token() will attempt to read a .env file at WORKSPACE/.env or ~/.openclaw/workspace/.env to retrieve NEON_API_KEY. The SKILL.md does not document this file read or the use of the WORKSPACE env var. Reading user files (even only to find a token) is scope creep relative to the declared behavior and should be disclosed.
✓ 安装机制
No install spec; the skill is instruction/code-only and uses only Python stdlib (no external downloads or package installs). This is low risk from an install mechanism perspective.
ℹ 凭证需求
The only required credential is NEON_API_KEY (declared as primary), which is proportionate. However, the script also reads the WORKSPACE environment variable (to locate a .env file) and will read ~/.openclaw/workspace/.env if present. Those env/config path usages are not declared in metadata and could cause the skill to access files the user did not expect.
✓ 持久化与权限
always is false and the skill does not request persistent installation or system-wide config changes. It does not modify other skills or system settings. Autonomous invocation remains allowed (platform default).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/6
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install neon
镜像加速npx clawhub@latest install neon --registry https://cn.longxiaskill.com