📦 PinMe Deploy - IPFS网站部署
v1.0.0一键将前端静态网站部署到 IPFS 网络。 适用场景： (1) 部署静态网站、HTML 页面或前端项目 (2) 提及 pinme、IPFS 部署、静态托管 (3) 快速预览或分享前端作品 (4) 发布、上传、部署静态页面 自动识别项目类型、构建并上传至 IPFS，返回可访问 URL。
0· 16·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
high confidenceThe skill generally matches a Pinata/IPFS deployer, but there are clear mismatches in declared requirements vs. runtime instructions and unexplained features (ENS/team sharing/incremental) that require additional credentials or tooling.
评估建议
This skill looks like a legitimate Pinata-based deployer but has a few red flags you should consider before installing: (1) SKILL.md runs npm install / npm run build but the skill does not declare npm/node as required — ensure your environment has Node/npm or the commands will fail. (2) Features like ENS binding and team sharing imply additional credentials (wallet/private key, team tokens) that are not requested; ask the author how those are implemented and what extra permissions are needed. (3...详细分析 ▾
⚠ 用途与能力
The skill's primary goal—uploading static sites to IPFS via Pinata—matches the required PINATA_API_KEY and PINATA_SECRET_KEY and the curl-based upload in SKILL.md. However, several advertised capabilities (ENS binding, team sharing, deployment statistics, incremental updates) either require other services/credentials (e.g., an Ethereum wallet or ENS write authority) or additional APIs that are not declared. Also the SKILL.md instructs npm install/npm run build but the declared required binaries list does not include npm/node, which is a direct mismatch.
⚠ 指令范围
The runtime instructions tell the agent to list directories, run npm install and npm run build, and upload local build files to Pinata using curl. Those actions inherently read arbitrary files under the specified project path and transmit files to an external service (Pinata). This is expected for a deployer, but it grants the skill broad access to local filesystem contents — the instructions do not define safeguards or limit which files to include, raising risk of accidental exfiltration if run on the wrong path.
✓ 安装机制
No install spec and no code files are present (instruction-only), so nothing is downloaded or written during install. This reduces installation risk.
ℹ 凭证需求
The skill requests only PINATA_API_KEY and PINATA_SECRET_KEY, which are appropriate for Pinata uploads. That is proportionate. However, advertised features (ENS, team sharing) would normally require other credentials (wallet/private key, team service tokens) that are not requested—this is an unexplained capability mismatch. Also SKILL.md expects npm/node to be available but these are not listed in required binaries.
✓ 持久化与权限
always:false and no config paths requested. The skill does not request permanent platform-level presence or modify other skills' configs. Autonomous invocation is allowed (default) but not combined with 'always:true' or broad undeclared credential access.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/21
init
● 无害
安装命令
点击复制官方npx clawhub@latest install pinme-deploy
镜像加速npx clawhub@latest install pinme-deploy --registry https://cn.longxiaskill.com