🚂 Railway — 一键云托管
v1.0.0Railway 提供 CLI 与仪表盘，一键部署 Git 仓库到云端，自动扩缩容、管理环境变量与数据库，支持多项目并行开发，零配置上线 Web 服务。
0· 344·4 当前·4 累计
by @aiwithabidi 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be a straightforward Railway CLI and asks only for a RAILWAY_API_TOKEN. Before installing, consider: 1) Review the included scripts (you already have them) — the script will try to read a .env file at WORKSPACE/.env or ~/.openclaw/workspace/.env as a fallback for the token; make sure that file does not contain other secrets you don't want the skill to read. 2) Provide a dedicated Railway token with minimal needed scope rather than a full-privilege account. 3) If you want to...详细分析 ▾
✓ 用途与能力
Name/description, declared env var (RAILWAY_API_TOKEN), and the included CLI implementation all align with a Railway platform client. The GraphQL endpoint used (backboard.railway.app/graphql/v2) matches the stated purpose.
ℹ 指令范围
SKILL.md instructs running the included Python script with RAILWAY_API_TOKEN set. The runtime script behaves as described, but it also attempts a fallback: reading a .env file from a workspace path (WORKSPACE or default ~/.openclaw/workspace/.env). That file-read behavior is not documented in SKILL.md and expands the instruction scope beyond what the metadata declares.
✓ 安装机制
No install spec; this is instruction-only plus a single Python script that uses only the stdlib. There is no download-from-URL or package installation that would write/execute arbitrary third-party code.
ℹ 凭证需求
The skill only requires RAILWAY_API_TOKEN (primary credential), which is proportionate. However, the script will also read WORKSPACE (an environment variable) to locate a .env file and parse RAILWAY_API_TOKEN from it if the env var is not set—this implicit file access and use of WORKSPACE is not declared under 'required config paths' and could cause unexpected credential reads.
✓ 持久化与权限
always is false and the skill does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other high-risk factors.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/6
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install railway
镜像加速npx clawhub@latest install railway --registry https://cn.longxiaskill.com