📦 Strapi CMS — 管理Strapi内容
v1.0.0通过官方 @strapi/client SDK 管理 Strapi CMS，支持集合类型、单例与媒体文件的 CRUD 操作，一键上传文件到媒体库。
0· 752·1 当前·1 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears coherent and implements a Strapi client CLI as claimed. Before installing: 1) Confirm the skill source/author (homepage is missing and owner ID is unknown). 2) Use a Strapi API token with the minimum permissions you need (prefer a read-only token if you only need inspection). 3) Be aware the skill runs local Node commands (npx tsx ...) and may cause npx to fetch dev tooling at runtime — run in an isolated environment or review package-lock.json first. 4) Schema-write and layou...详细分析 ▾
✓ 用途与能力
Name/description match the code and handlers. Required env vars (STRAPI_API_TOKEN, STRAPI_BASE_URL) and the node runtime are appropriate and necessary for using @strapi/client. Declared permissions (network) and the documented capabilities (CRUD, media upload, schema introspection, i18n) align with the implementation.
✓ 指令范围
SKILL.md and instructions.md direct the agent to run the local CLI wrapper (npx tsx src/index.ts) and to use only the declared environment variables. The instructions do not ask the agent to read unrelated system files or exfiltrate data to third-party endpoints. Raw fetch functionality is limited to Strapi endpoints (via the client).
ℹ 安装机制
The package is a normal Node skill (package.json depends on @strapi/client). No arbitrary external download URLs are used. However, the install spec in metadata is unusual: it lists an install item with kind 'node' and package '.' that declares it 'creates' a 'node' binary — that mapping is incoherent (you wouldn't install the Node runtime from the skill package). Also runtime usage expects 'tsx' (a devDependency) invoked via npx, which may cause npx to fetch packages at runtime. These are implementation/packaging oddities rather than indicators of malicious behavior, but worth confirming.
✓ 凭证需求
Only two environment values are required: STRAPI_API_TOKEN (primary credential) and STRAPI_BASE_URL. Both are necessary and proportionate for accessing a Strapi API. There are no unrelated secrets requested.
✓ 持久化与权限
Skill does not request always:true and does not declare any system-wide config changes. Its manifest and instructions operate within the skill's own directory and runtime; autonomous invocation is permitted (platform default) but not combined with elevated privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/19
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install strapi
镜像加速npx clawhub@latest install strapi --registry https://cn.longxiaskill.com