📦 Deployment Kit — 生产级部署套件
v0.1.0基于 Docker 与 GitHub Actions 的多阶段构建、CI/CD 流水线及健康检查，一键完成生产环境部署。
0· 96·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill largely behaves like a local Docker/CICD deployment helper, but there are several red flags to consider before installing or running it: 1) SKILL.md asks you to configure OPENAI_API_KEY (and 'other env vars') even though the included code does not use OpenAI — do not supply any secret keys until the author explains why they're needed. 2) The code runs shell commands (docker build/run, netstat, docker logs). That means running this skill will execute commands on your machine — ensure D...详细分析 ▾
ℹ 用途与能力
Files (docker-compose, deploy manager, health check, CI/CD mention) align with a deployment kit. However SKILL.md's '注意事项' asks to set OPENAI_API_KEY (and '等环境变量') even though the codebase does not consume OpenAI credentials — this is an unexplained mismatch.
⚠ 指令范围
Runtime instructions focus on building/running Docker and running the local health-check script (good), but examples in SKILL.md reference importing runHealthChecks from scripts/health-check.js although the script does not export that function. SKILL.md also asks user to set OPENAI_API_KEY (sensitive) without showing any runtime step that uses it. Some commands and examples are inconsistent (path and export mismatches), giving the agent or user too much ambiguous discretion.
✓ 安装机制
No install spec (instruction-only) and all code is included in the bundle. Nothing is downloaded from external URLs during install, so install risk is low.
⚠ 凭证需求
Manifest declares no required env vars, but SKILL.md instructs to configure OPENAI_API_KEY and '等环境变量' on first run. Requesting an API key for an unrelated provider (OpenAI) is disproportionate and is not justified by the provided source code.
✓ 持久化与权限
Skill is not always-enabled and does not request elevated or persistent platform-wide privileges. It does execute local shell commands (docker, netstat) which is expected for a deployment tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/27
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install yuyonghao-deployment-kit
镜像加速npx clawhub@latest install yuyonghao-deployment-kit --registry https://cn.longxiaskill.com