by 安全扫描
OpenClaw
可疑
high confidenceNULL
评估建议
This skill appears to be intended for managing Vapi voice agents, which would legitimately need a VAPI_API_KEY — but the bundle is inconsistent: the manifest contains only SKILL.md, yet the docs reference a local helper script that is not included and recommend running a remote install script via curl | bash. Before installing or using this skill: 1) Confirm whether the missing helper file (skills/vapi/bin/vapi-api.mjs) should be included; ask the publisher for the full package or source. 2) Do ...详细分析 ▾
⚠ 用途与能力
SKILL.md describes managing Vapi assistants, calls, phone numbers, tools, and webhooks — which is coherent with needing a Vapi API key. However the package metadata lacks a description and declares no required env vars or code files, while the README references a helper script (skills/vapi/bin/vapi-api.mjs) that is not present in the manifest. The absence of the promised helper file and missing description/metadata are inconsistent with the claimed capability.
⚠ 指令范围
Runtime instructions ask the agent/operator to supply VAPI_API_KEY, run a Node helper script (examples use skills/vapi/bin/vapi-api.mjs), and optionally install the Vapi CLI. The skill doc also instructs running external install scripts (curl -sSL https://vapi.ai/install.sh | bash). The SKILL.md therefore directs agent operators to install and run external code and to export secrets — but the bundle does not contain the referenced helper script, creating a gap between instructions and delivered artifacts.
⚠ 安装机制
There is no formal install spec in the package, but SKILL.md recommends installing the Vapi CLI by piping a remote install.sh from vapi.ai into bash (curl | bash). That pattern is high-risk because it runs remote code without local inspection. The skill also refers to a local Node helper that is not present in the skill bundle, so it's unclear whether users are expected to fetch code from external locations.
⚠ 凭证需求
The registry metadata lists no required env vars, yet SKILL.md clearly requires a VAPI_API_KEY (and optionally VAPI_MODE). Requesting a single API key is proportionate to the stated functionality; the problem is the metadata/manifest failing to declare that secret and the skill instructing users to place secrets in their shell or gateway. This mismatch is an incoherence that could lead to unexpected secret handling.
✓ 持久化与权限
The skill does not request persistent presence (always:false) and does not declare modifications to other skills or system-wide settings. It does instruct users to store the API key as an env var or gateway secret, which is normal for an API-integration skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/7
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install vapi-skill
镜像加速npx clawhub@latest install vapi-skill --registry https://cn.longxiaskill.com