by 安全扫描
OpenClaw
安全
medium confidenceThe instructions match the stated purpose (building and installing structsd) but they require running a remote install script (curl | bash) and performing privileged writes to /usr/local — review sources before running.
评估建议
This skill appears to do what it says (install structsd), but before running the instructions: 1) Inspect the remote installer script at https://get.ignite.com/cli to ensure it is trustworthy — piping curl to bash runs arbitrary code on your machine. 2) Prefer package-manager installs or verified release artifacts where possible, and verify checksums for downloaded tarballs. 3) Be aware the process uses sudo to write to /usr/local and edits your shell init files to add ~/go/bin to PATH. 4) Verif...详细分析 ▾
✓ 用途与能力
The skill name/description (install structsd) aligns with the instructions: installing Go, Ignite CLI, cloning the structsd repo, and building. Nothing in the SKILL.md asks for unrelated credentials or system access beyond what an installer would need. Minor metadata mismatch: _meta.json reports version 1.0.1 while registry metadata lists 1.2.0; this is an inconsistency in packaging but not necessarily malicious.
ℹ 指令范围
Instructions stay within install/upgrade scope (download Go, extract to /usr/local, add ~/go/bin to PATH, install Ignite, git clone, build). They modify user shell init files and write to /usr/local, which is expected for tool installation but requires sudo/privilege. No instructions attempt to read unrelated files or export other credentials.
⚠ 安装机制
There is no packaged install spec (instruction-only). Downloads: Go tarballs are from the official go.dev host (expected). The Ignite install uses a curl ... | bash pattern (curl https://get.ignite.com/cli! | bash), which executes a remote script without local review — this is a high-risk installation pattern even if the site is legitimate. Building from a GitHub repo (git clone then ignite chain build) is expected. Recommend inspecting the remote install script or using a vetted package manager/release instead of piping to bash.
✓ 凭证需求
The skill declares no required env vars or credentials and the instructions don't read or transmit secrets. PATH modification is appropriate for making the built binary available.
✓ 持久化与权限
always:false and the skill does not request persistent platform privileges. The only persistent changes are user-level PATH edits (~/.profile or ~/.zshrc) and writing Go to /usr/local, which are normal for an installer. The skill does not modify other skills or system-wide agent config.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/3/2
structstestnet-111 compatible, synced with upstream
● 无害
安装命令
点击复制官方npx clawhub@latest install structsd-install
镜像加速npx clawhub@latest install structsd-install --registry https://cn.longxiaskill.com镜像同步中