by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's declared purpose (querying TTPOS data) matches the single API key it requests, but the skill will construct and POST arbitrary SQL to a remote service of unknown provenance and includes behavior (hiding raw field names) that makes auditing harder—so proceed only after verifying the backend and limiting key scope.
评估建议
This skill is internally consistent (it needs one API key to query TTPOS), but it will construct and execute arbitrary SQL on a remote service (https://claw.doge6.com) whose source/homepage is not provided. Before installing: 1) Verify the backend service and vendor (do you trust claw.doge6.com and the owner?) and prefer an official homepage or source. 2) Only supply an API key that is scoped with least privilege (read-only, limited companies/tenants, short TTL) — do not use high-privilege or cl...详细分析 ▾
✓ 用途与能力
Name/description say it queries TTPOS via the ttpos-agent API and the only required secret is LIGHT_BRIDGE_API_KEY — this aligns with the stated purpose.
ℹ 指令范围
SKILL.md instructs the agent to fetch a guide, list companies, construct SQL based on that guide, and POST arbitrary SQL to /api/v1/query/execute. That is coherent for a query/reporting tool, but giving the skill ability to compose and execute arbitrary SQL remotely increases data-exfiltration risk; the guidance to suppress raw field names and translate enumerations reduces transparency/auditability of returned results.
✓ 安装机制
Instruction-only skill with no install step or downloaded code — minimal installation risk.
ℹ 凭证需求
Only LIGHT_BRIDGE_API_KEY is required (plus an optional LIGHT_BRIDGE_URL). That is proportionate to a remote-API query skill. However, the single API key grants whatever access the backend exposes; there is no indication of recommended least-privilege scopes or limits.
✓ 持久化与权限
always is false and the skill is user-invocable; it does not request persistent elevated privileges or modify other skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/19
ttpos-agent 1.0.1 - No file changes detected in this version. - No modifications made to documentation or code. - Functionality and usage remain unchanged from previous version.
● 可疑
安装命令
点击复制官方npx clawhub@latest install ttpos-agent
镜像加速npx clawhub@latest install ttpos-agent --registry https://cn.longxiaskill.com