by 安全扫描
OpenClaw
安全
medium confidenceThe SKILL.md is internally consistent with a Python SDK for inference.sh — examples, agents, file uploads, and tool-builder patterns match the description — but there are a few documentation/metadata discrepancies and obvious operational risks (API key use, file uploads, webhook/web requests, and example use of eval) that you should understand before using it.
评估建议
This skill appears to be a documentation-only SDK integration for inference.sh and is coherent with that purpose — but take the following precautions before using it: 1) The SDK requires an inference.sh API key (examples use INFERENCE_API_KEY) even though the skill metadata lists no required env vars; treat that key like any secret and limit its scope. 2) Examples show automatic upload of local file paths and large-file multipart uploads — avoid pointing the SDK at sensitive files unless you int...详细分析 ▾
✓ 用途与能力
The name/description (Python SDK for inference.sh) matches the content: examples for sync/async clients, agents, tool-builder, file uploads, sessions, and streaming. The allowed tools (pip, python) and examples align with the declared purpose.
ℹ 指令范围
The runtime instructions are focused on SDK usage and remain within the SDK's purpose. However, the docs include examples that read local files, auto-upload file paths, use multipart uploads, and show how to enable code execution and eval-style handlers — all legitimate SDK features but they expand the agent's I/O surface and can send local data to an external service if used. The SKILL.md also shows webhook tools that call arbitrary external endpoints.
✓ 安装机制
This is instruction-only with no install spec and no code shipped in the skill bundle, so nothing is written to disk by the skill itself. The documented install (pip install inferencesh) is standard for a Python SDK but is external to the skill bundle.
ℹ 凭证需求
The skill metadata declares no required environment variables, but the SKILL.md repeatedly shows using an API key (api_key parameter or INFERENCE_API_KEY env var). That mismatch is a documentation/metadata inconsistency: in practice the SDK needs an inference.sh API key to function. Examples also reference webhook secrets and third-party tokens (e.g., GITHUB_TOKEN, Slack webhooks) as part of examples—expected for integrations but not declared by the skill metadata.
✓ 持久化与权限
The skill does not request always:true, no install, no config path access, and does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed (default) but is not combined with other elevated privileges here.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.52026/2/6
- Initial public release of the Python SDK for inference.sh. - Run, stream, and manage AI apps with support for 150+ models. - Includes agent/assistant building: template and ad-hoc agent support with tools and human approval flows. - Features file upload API (automatic/manual) and session management for stateful execution. - Tool builder API enables creation of custom, app, agent, webhook, and internal tools. - Supports both synchronous and asynchronous (async) operation modes.
● 可疑
安装命令
点击复制官方npx clawhub@latest install python-sdk
镜像加速npx clawhub@latest install python-sdk --registry https://cn.longxiaskill.com