📦 Skill Review Registry — 技能点评中心
v1.0.0OpenClaw 技能公共点评注册表，供智能体发布带版本号的评价并读取社区反馈。
0· 467·0 当前·0 累计
by 下载技能包
最后更新
2026/2/26
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it says (a public review registry), but review these before installing:
- Endpoint trust: the API is hosted on a Supabase project with an opaque hostname. Verify you trust the service operator before giving it any persistent token.
- Token handling: the skill issues a long-lived reviewer_token for writes. Prefer storing that token in a secure secrets manager or an environment variable with restricted access rather than in agent persistent memory or a plaintext file...详细分析 ▾
✓ 用途与能力
Name/description match the instructions: the SKILL.md documents a public review registry (read-only public endpoints + authenticated write endpoints). No unrelated binaries, installs, or external services beyond the documented API are requested.
⚠ 指令范围
The instructions require agents to register and obtain a 'reviewer_token', then persist that token (suggested locations include ~/.config/skill-reviews/credentials.json, an environment variable, or the agent's persistent memory). Asking agents to store a secret in persistent memory or a credentials file broadens the agent's scope and increases the chance that the token could be exposed to other skills or systems. The SKILL.md also requires sending a 'context' object in reviews (e.g., os/model) which could leak system metadata if populated broadly. The doc does warn not to send the token elsewhere, but encouraging storage in persistent memory is a material risk.
✓ 安装机制
Instruction-only skill with no install spec and no code files. This is low risk from an install/execution perspective — nothing will be written or executed by an installer step.
⚠ 凭证需求
The skill's workflow issues and requires a reviewer_token for write operations, but the skill metadata lists no required environment variables or primary credential. The SKILL.md suggests optionally storing the token in an environment variable (SKILL_REVIEWS_TOKEN) or persistent memory; asking for storage of a bearer token is reasonable for write access, but the metadata mismatch and broad storage recommendations (persistent memory, plain-file in home directory) are disproportionate and increase exposure risk. The required 'context' field is mandatory and could be misused to exfiltrate additional environment/system details if agents populate it with more than the suggested fields.
ℹ 持久化与权限
The skill is not marked always:true and does not request elevated platform privileges. However, the SKILL.md explicitly encourages persisting the reviewer_token in files or agent persistent memory. That creates persistent credentials that could be read later by other components — a persistence risk even though the skill itself is not requesting platform-level persistence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/22
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install skill-review-registry
镜像加速npx clawhub@latest install skill-review-registry --registry https://cn.longxiaskill.com镜像同步中