📦 Tally — 表单生成
v1.0.0无需登录即可通过API创建并编辑Tally表单，支持文本、多选、复选、评分等所有题型，可程序化快速构建调查问卷与反馈收集。
1· 1.8k·1 当前·1 累计
by 下载技能包
最后更新
2026/2/27
安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill appears to implement the advertised Tally API usage, but its metadata omits credential/config requirements that the instructions clearly use. Before installing: confirm the skill's provenance (source/homepage), require the author to declare that it needs a Tally API key and the expected config path or accept a provided env var, and review the full SKILL.md (it was truncated in the manifest). If you proceed, store the Tally API key in a secure credential store or agent-managed secret (...详细分析 ▾
✓ 用途与能力
Name/description match the SKILL.md: it documents using the Tally.so REST API to create and edit forms and gives block schemas and curl examples. The functional intent is coherent with a Tally API helper.
⚠ 指令范围
The runtime instructions explicitly tell the agent to read an API key from ~/.config/tally/api_key, to write/read /tmp/backup.json and /tmp/form.json, and to run curl against api.tally.so. Reading the user's filesystem (home config) and writing to /tmp are outside what the manifest declares and widen the skill's effective scope.
✓ 安装机制
No install spec or code files are present (instruction-only). This reduces installation risk because nothing is downloaded or written during install, but runtime instructions still perform network and local file actions.
⚠ 凭证需求
SKILL.md expects a TALLY_KEY (via cat ~/.config/tally/api_key and exporting TALLY_KEY) but the registry metadata declares no required env vars, no primary credential, and no required config paths. Requesting/using a local API key is reasonable for this skill, but it should be declared explicitly in the metadata; the omission is a proportionality/information gap.
✓ 持久化与权限
The skill is not marked always:true and has no install-time persistence. Autonomous invocation is allowed (platform default) but not, by itself, a red flag. The skill does instruct writing to /tmp at runtime (temporary backups), which is expected for a form update flow but should be disclosed.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/1/29
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install tally
镜像加速npx clawhub@latest install tally --registry https://cn.longxiaskill.com