📦 Pipeworx colorapi — 色码方案转换
v1.0.0调用 TheColorAPI 完成颜色识别、配色方案生成及多格式（hex、RGB、HSL、CMYK）互转，一键生成专业色板，提升设计效率。
0· 60·0 当前·0 累计
by 下载技能包
最后更新
2026/4/8
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it says (call a color service via HTTP) and requires only curl, but review two points before installing:
1) Gateway vs upstream: the example uses gateway.pipeworx.io instead of thecolorapi.com. Confirm you trust the gateway operator (pipeworx) because your color data will pass through that proxy.
2) Setup hint downloads code: the SKILL.md suggests running 'npx -y mcp-remote@latest ...' which will fetch and run code from npm. If you plan to follow that setup, verify...详细分析 ▾
ℹ 用途与能力
The name/description (color identification, scheme generation, conversions) align with the documented curl examples to a JSON-RPC gateway. However the skill references 'TheColorAPI' conceptually but the example and homepage use an external gateway (https://gateway.pipeworx.io) rather than thecolorapi.com. That proxying is plausible but not explained and should be justified.
ℹ 指令范围
SKILL.md instructs only HTTP calls (curl) and describes three narrowly-scoped tools (identify_color, generate_scheme, convert_color). It does not instruct reading local files or unrelated env vars. One additional instruction block (Setup) suggests running an npx command to register an mcp server — this step would execute downloaded code and is not declared elsewhere in the skill, which widens the runtime actions if followed.
ℹ 安装机制
There is no formal install spec (lowest-risk form). However the provided 'Setup' example tells users to run 'npx -y mcp-remote@latest ...' which would download and execute a package from npm. The skill metadata does not declare Node/npx as required binaries, nor does it declare this installation. That mismatch is a small but meaningful risk (runtime download/execution of remote code).
✓ 凭证需求
The skill requests no environment variables or credentials. That is proportionate to a read-only color API integration. There are no unexpected secret requests.
✓ 持久化与权限
always is false and there are no instructions to modify other skills or global agent settings. The skill does suggest adding an mcpServers entry in agent config for a remote endpoint, which is normal but should be done consciously by the operator.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install pipeworx-colorapi
镜像加速npx clawhub@latest install pipeworx-colorapi --registry https://cn.longxiaskill.com镜像同步中