by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears to be a monetization wrapper: the agent performs the summarization and must POST to the skill's /charge endpoint to collect $0.005 USDT per call. Before installing, verify the following: (1) Confirm you trust the skill owner and the Cloudflare Workers subdomain (sea-doc-summarizer.swmengappdev.workers.dev) — there is no homepage or provenance info. (2) Inspect the shared billing implementation (the code imports ../../shared/billing which is not included here) or ask the publis...详细分析 ▾
ℹ 用途与能力
The name/description promise a multilingual summarizer. The SKILL.md instructs the agent how to summarize (language detection heuristics, output format) and to POST to a /charge endpoint to collect payment. The code only implements the charging endpoint (no summarization API), which is coherent if the skill's approach is: agent does summarization and the skill enforces payment. This design is unusual (users may expect a hosted summarization API), but not inherently incoherent.
✓ 指令范围
Runtime instructions ask the agent to detect language, summarize/translate as needed, extract entities, and return JSON. They do not instruct reading unrelated system files or exfiltrating secrets. The only external call specified is a POST to the skill's /charge endpoint with a user_id (no document content). That aligns with the declared billing purpose and does not expand scope to unrelated data collection.
✓ 安装机制
No install spec; this is primarily instruction-driven with a small worker source file. No downloads or unusual install steps are present. The included wrangler.toml indicates intended Cloudflare Worker hosting, which matches the endpoint URL used in SKILL.md.
✓ 凭证需求
Only SKILLPAY_API_KEY is required, which is proportionate for a skill that performs billing. There are no additional tokens, SSH keys, or unrelated credentials requested.
✓ 持久化与权限
always is false and the skill does not request system-level persistence. It only expects a SkillPay API key and exposes a payment endpoint — no elevated platform privileges are requested.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.02026/3/7
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install sea-doc-summarizer
镜像加速npx clawhub@latest install sea-doc-summarizer --registry https://cn.longxiaskill.com