by 安全扫描
OpenClaw
安全
high confidenceThe skill's stated purpose (Docker assistance) matches its minimal instruction-only content; it does not request credentials or install anything, but the SKILL.md is vague about required system access (Docker daemon, registry auth).
评估建议
This skill appears coherent for Docker help but is intentionally vague. Before installing/using it: (1) ask the publisher/source for details and a homepage or repo; (2) expect the agent to request access to your Docker daemon or registry credentials if you ask it to build/push images — do not provide those unless you trust the skill; (3) when testing, run the agent in an isolated environment (throwaway VM or container) to avoid exposing your host's docker socket or secrets; (4) prefer skills tha...详细分析 ▾
✓ 用途与能力
Name, description, and triggers all describe Docker/container tasks (container operations, Dockerfile, build, network). The skill declares no unrelated binaries, env vars, or config paths — this is consistent with an instruction-only helper.
ℹ 指令范围
The SKILL.md is very high-level and contains no concrete commands, file paths, or declared auth flows. That vagueness gives the agent broad discretion at runtime (e.g., to run docker CLI, read system state, or ask for access to the Docker socket). This is not inherently malicious, but you should expect follow-up requests for system-level access when using the skill.
✓ 安装机制
No install spec and no code files — instruction-only. This is the lowest-risk install model because nothing is written or executed automatically by an installer.
ℹ 凭证需求
The skill declares no required environment variables or credentials. However, one of its described features is 'build and push to registry', which normally requires registry credentials or Docker config (~/.docker/config.json) and access to the Docker daemon. The omission is an informational gap rather than an explicit mismatch, but expect the agent to request such credentials or prompt you to expose the docker socket at runtime.
✓ 持久化与权限
always:false (no forced permanent presence). disable-model-invocation is false meaning autonomous invocation is allowed — this is the platform default and not concerning by itself. The skill does not declare any capability to modify other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/4/11
- Updated the English description for clarity and added new trigger keywords: docker, container, dockerfile, docker build. - Version number updated from 1.0.1 to 1.0.2 in SKILL.md. - No changes to functionality or usage instructions.
● 无害
安装命令
点击复制官方npx clawhub@latest install skylv-docker-helper
镜像加速npx clawhub@latest install skylv-docker-helper --registry https://cn.longxiaskill.com