by 安全扫描
OpenClaw
安全
high confidenceThis is an instruction-only skill that provides documentation and YAML schema examples for building REST API extraction specs; it contains no install steps, code, or unexplained credential requests and is internally consistent with its stated purpose.
评估建议
This bundle is documentation and examples for authoring Sling-style REST API extraction YAML specs — it contains no executables. It does, however, show how specs can consume secrets (secrets.*) and environment variables and how processors can write env.* and persisted sync state. Before using or running any spec created from these docs: (1) inspect specs for any endpoints or external URLs you don't trust, (2) avoid embedding real credentials directly in spec files, (3) only provide the minimal c...详细分析 ▾
✓ 用途与能力
Name/description claim to build API specs; the files and examples are entirely about authentication types, pagination, response processing, queues, incremental sync, and dynamic endpoints — all coherent with an API-spec builder. The skill does not request unrelated binaries or credentials in its registry metadata.
ℹ 指令范围
SKILL.md and the included docs instruct how to author specs and show example runtime actions (parse/test). The docs reference secrets.* and env.* placeholders and include examples that set environment variables (e.g., env.LAST_UPDATE, OVERRIDE_START_DATE). That behavior is expected for a spec authoring tool, but you should understand that specs created from this guidance can read and require credential values and may write to environment/state at runtime — review any spec before executing it.
✓ 安装机制
No install spec and no code files to execute — this is instruction-only. No remote downloads or package installs are present in the bundle.
ℹ 凭证需求
The documentation documents many auth types (OAuth2, AWS sigv4, HMAC, API keys, basic, device flow) and uses placeholders like {secrets.*} and {env.*}. The skill package itself does not request credentials, which is appropriate for a generic spec library, but users will need to supply relevant credentials when running generated specs. Be cautious about which secrets you provide to any runtime that executes specs built from these documents.
✓ 持久化与权限
The skill is not always-installed and does not declare elevated privileges. It does not modify other skills or system-wide agent configuration. The documentation describes persisting sync state as part of normal replication workflows — expected for this domain.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/27
- Initial release of the sling-api-specs skill. - Provides tools and documentation to build REST API specifications for Sling data extraction. - Supports multiple authentication methods, complex pagination, response processing, rate limiting, and endpoint chaining. - Includes YAML spec structure examples and operations for parsing and testing API specs. - Offers detailed topic-based reference guides for authentication, request/response handling, pagination, variable scopes, and more.
● 可疑
安装命令
点击复制官方npx clawhub@latest install sling-api-specs
镜像加速npx clawhub@latest install sling-api-specs --registry https://cn.longxiaskill.com