by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it says (create a SwarmSync account and publish your agent), but before installing or running it: (1) inspect scripts/register.sh locally (you already have it) to confirm you are comfortable with it reading ~/.openclaw/workspace/SOUL.md and writing ~/.openclaw/.env; (2) if you care about privacy, open SOUL.md to see what will be published; (3) consider running the script with --dry-run first to see the API calls it would make; (4) verify the api.swarmsync.ai domain ...详细分析 ▾
ℹ 用途与能力
The skill's name and description match what the code does: it registers/publishes an agent to SwarmSync and configures an AP2 endpoint. The operations (POST to api.swarmsync.ai, publish agent profile, read SOUL.md, save tokens) are appropriate for the stated purpose. However, registry metadata claims no required environment variables while SKILL.md metadata and the script expect/produce SWARMSYNC_* credentials (primaryEnv=SWARMSYNC_ACCESS_TOKEN). This mismatch in declared requirements is inconsistent and worth attention.
ℹ 指令范围
The SKILL.md directs the agent to run scripts/register.sh. The script reads ~/.openclaw/workspace/SOUL.md to extract agent name/bio/capabilities, calls only https://api.swarmsync.ai (and references the agents gateway host), and writes credentials to ~/.openclaw/.env. The actions are within the registration scope, but reading a local SOUL.md and persisting credentials are privacy-sensitive; the script will auto-generate an email/password if none exist and will prompt interactively as a fallback.
ℹ 安装机制
No external binary downloads or archive extraction are performed. The script depends on common tools (curl, jq, openssl). SKILL.md metadata lists optional brew/winget instructions to install jq; there is no separate install spec in the registry metadata — a packaging inconsistency but not a high-risk install mechanism.
ℹ 凭证需求
The only credentials used/stored are SWARMSYNC_EMAIL, SWARMSYNC_PASSWORD, SWARMSYNC_ACCESS_TOKEN and agent identifiers — all reasonable for registering/publishing an agent. The script persists these to ~/.openclaw/.env and loads that file later. The script takes some safety steps (creates the file with chmod 600). Still, storing tokens locally and sourcing the .env are actions users should be aware of; the registry metadata's omission of these env values is inconsistent.
✓ 持久化与权限
The skill is not marked always:true and does not modify global agent/system settings beyond writing its own ~/.openclaw/.env. It does not request permanent platform-level privileges or alter other skills' configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/29
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install swarmsync-register
镜像加速npx clawhub@latest install swarmsync-register --registry https://cn.longxiaskill.com