by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements and behavior match its stated purpose (reading a workspace's openclaw.json, calling Discord to fetch bot metadata, downloading the avatar, and updating IDENTITY.md); nothing requested or installed appears disproportionate or unrelated.
评估建议
This skill appears coherent for syncing a Discord bot profile into a workspace identity. Before installing or running it: (1) Confirm you point it to the intended workspace path so it only reads that workspace's openclaw.json (it will use any token found there). (2) Inspect the workspace openclaw.json to ensure it doesn't contain unrelated secrets you don't want accessed. (3) Review the avatar file output location (workspace/avatars/) and the identity backup behavior (.bak). (4) If multiple Disc...详细分析 ▾
✓ 用途与能力
Name/description (sync Discord bot profile into IDENTITY.md, save avatar) align with the included script and SKILL.md. Required binaries (python3, curl) are reasonable for the described tasks. The skill reads workspace config and updates identity/avatars as expected.
✓ 指令范围
SKILL.md and the script restrict operations to the provided workspace, openclaw.json, IDENTITY.md, and workspace/avatars. The only external endpoints contacted are Discord API (discord.com) and the Discord CDN (cdn.discordapp.com), which are necessary to fetch the bot profile and avatar. The skill treats tokens as sensitive and does not echo them.
✓ 安装机制
Instruction-only skill with a small bundled Python script; there is no install spec that downloads arbitrary code from third-party URLs. No extract/download-based install operations are present.
ℹ 凭证需求
The skill does not request environment variables but does read tokens stored in the workspace's openclaw.json. This is appropriate for the purpose, but it means the skill will access whatever secrets are present in that workspace config—verify the selected workspace is correct and contains only tokens you intend to use.
✓ 持久化与权限
always is false and model invocation is not disabled (normal). The skill writes only to the current workspace (IDENTITY.md, workspace/avatars) and creates a .bak backup; it does not modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.12026/4/21
Read token from current workspace openclaw.json
● 无害
安装命令
点击复制官方npx clawhub@latest install sync-discord-identity
镜像加速npx clawhub@latest install sync-discord-identity --registry https://cn.longxiaskill.com