by 安全扫描
OpenClaw
安全
high confidence这是一个仅用于指令的辅助工具，专为 qjzd-nav CLI 身份验证流程设计，内部保持一致：仅需 qjzd-nav 二进制文件，其指令与所述目的相符。
评估建议
This skill is coherent and lightweight, but take these precautions before using it: (1) Verify the qjzd-nav binary is from a trusted source and on your system PATH — the skill will run that binary. (2) Avoid passing plaintext passwords on the command line (the examples use --password); prefer interactive entry or other secure input methods to prevent exposure via shell history or process listings. (3) Be aware the CLI will store secrets in your system keyring and may contact the configured serve...详细分析 ▾
✓ 用途与能力
Name/description describe CLI auth flows and the skill requires only the qjzd-nav binary; that is proportionate and expected for an auth helper.
ℹ 指令范围
SKILL.md confines itself to qjzd-nav auth commands (login, profile management, doctor, delete). It does reference that secrets live in the system keyring and shows examples using --password. Minor caution: the documentation encourages non-interactive use with --password and --force which can leak credentials via shell history or process lists; otherwise the instructions do not ask the agent to read unrelated files or credentials.
✓ 安装机制
No install spec and no code files — instruction-only. Nothing is downloaded or written to disk by the skill itself.
✓ 凭证需求
The skill declares no required env vars or credentials. It mentions that credentials are stored in the system keyring (expected for a CLI auth helper) but does not request unrelated secrets or external credentials.
✓ 持久化与权限
always is false and model invocation is normal. The skill does not request persistent system-wide privileges or attempt to modify other skills or agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.22026/4/19
## qjzd-nav-cli-auth 1.3.2 - 本版本未检测到文件变更。 - 功能与文档与上一版本保持一致。
● 无害
安装命令
点击复制官方npx clawhub@latest install qjzd-nav-cli-auth
镜像加速npx clawhub@latest install qjzd-nav-cli-auth --registry https://cn.longxiaskill.com
技能文档
在需要 qjzd-nav auth 和 qjzd-nav auth profile 时使用本 skill。若尚未完成认证，请先执行，再运行 link、category、tag、backup 或 settings 等命令。
命令
``bash
qjzd-nav auth --help
qjzd-nav auth login --help
qjzd-nav auth profile --help
` 主要工作流：
qjzd-nav auth loginqjzd-nav auth currentqjzd-nav auth profile listqjzd-nav auth profile currentqjzd-nav auth profile getqjzd-nav auth profile useqjzd-nav auth profile deleteqjzd-nav auth profile doctor
常用流程
使用密码登录（采用 RSA 加密）：
`bash
qjzd-nav auth login \
--profile default \
--url https://nav.qjzd.online \
--password
`
注：密码会先以服务器公钥加密再发送。 查看与切换 profile：
`bash
qjzd-nav auth current
qjzd-nav auth profile list
qjzd-nav auth profile use production
qjzd-nav auth profile get default --json
`
诊断损坏凭据：
`bash
qjzd-nav auth profile doctor
qjzd-nav auth profile delete production --force
`
规则
非交互模式下，qjzd-nav auth login必须提供--profile、--url和--password。若需结构化输出供其他工具使用，请加--json。profile delete为破坏性操作；非交互模式需加--force。- Profile 元数据保存在 config，机密信息保存在系统 keyring。
- CLI 使用 RSA 加密进行密码认证。
路由
链接、分类、标签相关请用qjzd-nav-cli-content。备份、恢复、设置相关请用qjzd-nav-cli-operations`。