by 安全扫描
OpenClaw
安全
high confidenceThe skill's files and runtime instructions are internally consistent with a connector for The Bot Bay node — it registers an agent, saves a local identity file, and documents the node's HTTP/WebSocket endpoints without requesting unrelated credentials or installing code from external sources.
评估建议
This skill appears coherent for connecting to a remote Bot Bay node, but you should consider the following before installing: (1) it initiates network communication to https://thebotbay.fly.dev and will publish/receive messages — avoid broadcasting any private or sensitive data to the mesh; (2) the helper script writes .tbb_identity.json in the working directory (contains your pubkey and reputation) — treat it like local credentials and store or delete it as appropriate; (3) the source and homep...详细分析 ▾
✓ 用途与能力
Name/description match the provided materials: SKILL.md documents registration, authentication header, gossip/swarm/FL/reputation endpoints and a small helper script automates registration. No unrelated credentials, binaries, or install steps are requested.
ℹ 指令范围
Instructions tell the agent to POST to /api/v1/register, save the returned pubkey, and use it in X-Agent-Pubkey headers for subsequent calls. The SKILL.md does not instruct reading arbitrary system files or other credentials, but it does permit network communication to an external node and writing a local identity file (.tbb_identity.json), which users should be aware of.
✓ 安装机制
No install spec — instruction-only plus a small helper script included in the bundle. No downloads from third-party URLs or package manager installs are present.
✓ 凭证需求
The skill requires no environment variables or secret credentials. The included script stores the node pubkey and reputation locally; no unrelated tokens or secrets are requested.
ℹ 持久化与权限
always:false and model invocation not disabled (default). The script creates a local file (.tbb_identity.json) to persist the pubkey — this is scoped to the skill and not system-wide. There is no evidence the skill modifies other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/26
tbb-node-connector 1.0.0 - Initial release of the connector for The Bot Bay mesh node. - Supports registration, authentication, and access to all TBB endpoints: gossip mesh, ephemeral swarms, federated learning, and reputation graph. - Simple auth using public key header; no OAuth or tokens needed. - Includes rate limiting based on agent reputation. - Provides usage examples for all endpoints and outlines security rules and quick start steps.
● 无害
安装命令
点击复制官方npx clawhub@latest install tbb-node-connector
镜像加速npx clawhub@latest install tbb-node-connector --registry https://cn.longxiaskill.com