by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill can perform real DeFi trades, cross-chain bridges, create agent wallets, and use paid proxies (email/SMS/scrape). Before installing: (1) Clarify the NEWSRIVER_API_KEY mismatch between the registry and SKILL.md. (2) Do not provide private keys; prefer limited, revocable API keys. (3) Test in dry_run/sandbox and with tiny amounts only. SKILL.md examples include a dry_run flag — use it. (4) Restrict or require explicit human approval for any autonomous execution that can move funds or in...详细分析 ▾
ℹ 用途与能力
The SKILL.md describes a DeFi super-aggregator, cross-chain bridging, historical news/price correlation, proxies (email/SMS/scrape) and TEE-backed agent wallets — all coherent with the stated purpose. However, registry metadata lists no required environment variables while the SKILL.md documents an optional NEWSRIVER_API_KEY; this mismatch (registry says none, documentation lists one) is an inconsistency the maintainer should clarify.
ℹ 指令范围
Runtime instructions are instruction-only curl/API examples that tell an agent how to query analytics and how to execute swaps/bridges/yield/bundles, create wallets, and use paid proxies. The instructions do not tell the agent to read local files or unrelated env vars, but they do enable network calls that can initiate real financial transactions and send data via email/SMS/scrape proxies — so the agent will be able to transmit data externally and move funds if execution is allowed.
✓ 安装机制
No install spec or code files are present (instruction-only). This is lower-risk from a disk/execution perspective because nothing is downloaded or written by the skill package itself.
ℹ 凭证需求
The registry lists no required environment variables, but SKILL.md documents an optional NEWSRIVER_API_KEY (used for premium/ subscription access). That alone is proportionate. However, the skill supports payments via an X-PAYMENT header (USDC on Base) and Privy-signed agent wallets — meaning monetary value can be moved through the API. The skill does not request private keys in the package, but it can cause charges and on-chain transfers; ensure any API key or payment mechanism you supply is scoped and reversible where possible.
⚠ 持久化与权限
always is false (good) and there is no install writing files, but the skill is allowed to be invoked autonomously (default). Because the skill exposes transaction/bridge/transfer endpoints and agent wallets, autonomous invocation could cause unintended asset movement or charges. Combine this with the metadata/instruction mismatches and you should tightly control or disable autonomous calls that perform financial operations.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.132026/3/4
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install newsriver-intelligence
镜像加速npx clawhub@latest install newsriver-intelligence --registry https://cn.longxiaskill.com