📦 OracleNet Mesh — AI代理信任层
v1.2.0接入OracleNet去中心化身份与信任网络，为AI代理颁发可验证DID、实时信誉评分，并一键调用98个链上预言机，实现跨服务安全协同与数据可信交互。
0· 68·0 当前·0 累计
by 下载技能包
最后更新
2026/4/6
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
What to consider before installing:
- This skill contacts third‑party services (tooloracle.io, feedoracle.io and several blockchain explorers). Confirm who operates those domains and whether the service is trustworthy and open‑source. There is no homepage or source code link in the package.
- The SKILL.md says free tier needs no key but mentions a paid X-API-Key header; ask the publisher whether and how API keys are used and whether the skill will ever prompt for them. The registry metadata curr...详细分析 ▾
ℹ 用途与能力
Name/description and the SKILL.md consistently describe a trust/identity mesh (join, scan domains, check reputation, rate, get verifiable passports). Required capabilities (network calls to an MCP endpoint, fetching JWKS, on‑chain verification) are coherent with that purpose. However, provenance is unclear: the skill references multiple domains (tooloracle.io for the MCP endpoint and feedoracle.io for JWKS) and has no homepage or source repo, so it's hard to verify the operator or claims.
ℹ 指令范围
Runtime instructions stay within the stated domain: they direct HTTPS JSON‑RPC calls, signature verification, and storing a locally generated node_id in the agent memory. They do not instruct reading arbitrary system files or unrelated environment variables. Remaining concerns: the skill directs the agent to send an agent identifier (e.g. openclaw://my-agent) to an external network—this can deanonymize the agent/user if the identifier contains personally identifying strings. The SKILL.md is truncated in the provided bundle, so the full behavioral rules were not available for review.
✓ 安装机制
Instruction-only skill with no install spec and no code files—nothing will be written to disk by the skill itself. This is the lowest install risk.
⚠ 凭证需求
The registry metadata lists no required env vars or primary credential, but the SKILL.md mentions a paid tier that uses an X-API-Key header. That API key requirement is not declared in the skill metadata, creating an inconsistency. The skill will make outbound network requests (MCP endpoint, JWKS URL, block explorers) to third‑party domains; no credentials are explicitly requested for free usage, but the undeclared paid-key expectation and multiple external domains increase risk and should be clarified.
ℹ 持久化与权限
The skill is not always: true and does not request elevated platform privileges. It asks the agent to store the returned node_id in the agent's internal state/memory. Persisting a mesh identity is a reasonable requirement for this use case, but it does carry privacy implications (long‑lived identifier linking agent activity across sessions) and the SKILL.md's admonition to 'not write it to shared logs' is advisory only.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/4/6
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install oraclenet-mesh
镜像加速npx clawhub@latest install oraclenet-mesh --registry https://cn.longxiaskill.com