by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions match its newsletter curation purpose, but it directs installing and running a third-party CLI via a remote script (curl | sh) and implies a login flow that may request credentials not declared — this mismatch and the remote install pattern are concerning.
评估建议
This skill appears to do what it says (templates, sourcing queries, editorial guidance), but exercise caution before following its install steps. The SKILL.md recommends running a remote installer with curl | sh and then running `infsh login` — both can execute code on your machine and may request/store credentials. Before installing: 1) inspect the installer script (visit https://cli.inference.sh) instead of piping it straight to shell; verify the SHA-256 checksums from the stated source; 2) co...详细分析 ▾
✓ 用途与能力
Name/description (newsletter curation) aligns with the SKILL.md: it provides templates, sourcing queries, and usage examples that call a content-sourcing CLI (infsh) and search apps (tavily, exa) to gather material for newsletters. The requested tools and commands are coherent with the stated goal.
ℹ 指令范围
Instructions stay within newsletter curation (content discovery, templates, image generation). However the runtime steps explicitly tell users/agents to execute a remote installer (curl https://cli.inference.sh | sh) and to run `infsh login` — both of which expand scope because they execute external code and may initiate credential flows not detailed in the skill.
⚠ 安装机制
There is no registry install spec, but SKILL.md instructs running a piped shell installer from https://cli.inference.sh which downloads a binary from dist.inference.sh. Download-and-pipe-to-sh is a high-risk pattern even if the doc claims SHA-256 verification is available; the installer behavior cannot be verified from the skill alone.
ℹ 凭证需求
The manifest declares no required env vars or credentials, which matches the skill text. But `infsh login` is part of the quick start and may prompt for service tokens/credentials at runtime — those credential requirements are not declared in the registry metadata and could grant broader access than the skill describes.
✓ 持久化与权限
The skill is instruction-only, always:false, and does not request persistent platform privileges or modify other skills. The only persistence risk comes from installing the external infsh binary (writes to disk) and any credentials that infsh may store after login.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.52026/2/10
- Added detailed documentation (SKILL.md) covering newsletter curation steps, formats, content sourcing, commentary techniques, and growth strategies. - Included practical command-line examples for content search and image header generation via inference.sh CLI. - Provided structured templates for different newsletter styles (link roundup, deep dive, essay, Q&A, data/trends). - Outlined proven tactics for increasing newsletter engagement and subscriber growth. - Explained best practices for issue formatting, sending cadence, and subject line writing.
● 可疑
安装命令
点击复制官方npx clawhub@latest install newsletter-curation
镜像加速npx clawhub@latest install newsletter-curation --registry https://cn.longxiaskill.com