by 安全扫描
OpenClaw
安全
high confidenceThe skill's files and instructions are internally consistent with its stated purpose: it searches the workspace for a Tokenrouter channel, may add a minimal model route to the found config, and then uses that channel's configured key to call the Tokenrouter video API (https://api.tokenrouter.com).
评估建议
This skill appears to do what it says: search your workspace for a Tokenrouter channel, possibly add a minimal model route, and call the Tokenrouter video API using whatever key is configured in that file. Before installing or running it, consider: (1) back up or commit your repo—the skill may edit config files; (2) review the specific config edits it proposes and confirm you want those changes; (3) verify you trust the skill/author because the agent will read any API keys stored in repo config ...详细分析 ▾
✓ 用途与能力
The name/description match the behavior in SKILL.md and the included script: it searches for tokenrouter/channel/provider config, checks for a channel pointing at api.tokenrouter.com or open.palebluedot.ai, adds a missing model route, and calls the video endpoints. Nothing requested (no external credentials, no unusual binaries) is unrelated to that purpose.
ℹ 指令范围
The runtime instructions explicitly direct the agent to scan workspace files and to edit the discovered tokenrouter config to add routes and reuse whatever API key is present. This is within the skill's stated scope, but it means the agent will read (and may write) configuration files and therefore access any secrets contained there.
✓ 安装机制
This is an instruction-only skill with no install spec. The included Python helper is small and intended to be run locally; no third-party downloads or archive extraction are present.
ℹ 凭证需求
The skill declares no required environment variables and does not request unrelated credentials. However, it will reuse API keys found in workspace config files (not via declared env vars). That behavior is appropriate for the task but worth noting because the agent will access in-repo secrets.
✓ 持久化与权限
The skill does not request always:true and has no install step that persists system-wide. It may be invoked autonomously by the agent (default), which is normal; there are no indications it attempts to modify other skills or global agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/4/21
Version 1.0.3 - Expanded and clarified model configuration instructions for video generation (SKILL.md). - Provided detailed rules for auto-configuring missing tokenrouter video model routes. - Added explicit API call patterns and supported model options for task creation and polling. - Improved config discovery workflow and update procedures for adding new models. - Ensured instruction consistency and detailed error/user feedback guidance.
● 可疑
安装命令
点击复制官方npx clawhub@latest install tokenrouter-generate-video
镜像加速npx clawhub@latest install tokenrouter-generate-video --registry https://cn.longxiaskill.com