by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill is coherent for deploying a local guild node via Docker Compose, but the actual code and containers come from an external GitHub repository. Before running: 1) Inspect the repository (docker-compose.yml, Dockerfiles, and referenced image tags). 2) Verify image sources and prefer pinned, signed, or official images; avoid running images from unknown registries without review. 3) Check for host volume mounts and exposed ports (to avoid sensitive host access). 4) Review .env and do not pl...详细分析 ▾
✓ 用途与能力
Name/description align with the runtime instructions: the SKILL.md explains how to clone a GitHub repo and run docker compose to get PostgreSQL-indexed game state. Required tooling (Docker, docker compose) and disk/sync expectations are proportionate.
ℹ 指令范围
Instructions are focused on setting up and querying the stack and do not ask for unrelated host files or credentials. However, they direct you to clone and run an external repo and to execute containers that will run arbitrary code and network services; this is expected for a 'deploy stack' skill but expands the trust boundary beyond the skill bundle itself.
ℹ 安装机制
This is an instruction-only skill (no install spec), which is low-risk for the package itself. Risk comes from following its instructions: cloning https://github.com/playstructs/docker-structs-guild and running docker compose will pull and execute container images from upstream. Confirm the repository, docker-compose.yml, and referenced images before running.
✓ 凭证需求
The registry metadata requests no credentials or config paths. SKILL.md shows creating a minimal .env (MONIKER, NETWORK_VERSION, NETWORK_CHAIN_ID) and uses an internal DB role (structs_indexer) inside the compose network — there are no unexplained requests for unrelated secrets.
✓ 持久化与权限
Skill is user-invocable and not always-enabled; it does not request persistent platform privileges nor modify other skills. Autonomous invocation is allowed by default but not unusual; nothing in the package requests elevated or permanent platform presence.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/3/2
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install structs-guild-stack
镜像加速npx clawhub@latest install structs-guild-stack --registry https://cn.longxiaskill.com