by 安全扫描
OpenClaw
安全
high confidenceThe skill is a minimal, instruction-only wrapper for the ZapYeti REST API and its requirements (curl, python3, ZAPYETI_API_KEY) match the stated purpose.
评估建议
This skill appears coherent and only needs your ZapYeti API key. Before installing, ensure the API key you provide has the minimal permissions needed (avoid full admin keys if possible). Be aware that the API includes endpoints capable of deleting accounts or creating API keys—avoid using overly-privileged keys with third-party agents. Keep your key secret, rotate it if you suspect compromise, and review ZapYeti's API token scopes and retention policies.详细分析 ▾
✓ 用途与能力
Name/description match the assets: the skill documents ZapYeti endpoints and includes a helper script that calls api.zapyeti.com. Required binaries (curl, python3) and the single env var ZAPYETI_API_KEY are expected for this purpose.
✓ 指令范围
SKILL.md instructs the agent to use scripts/zy_api.sh for API calls. The script only uses the declared ZAPYETI_API_KEY, builds requests to https://api.zapyeti.com, and pretty-prints JSON. There are no instructions to read unrelated files or exfiltrate data to other endpoints.
✓ 安装机制
No install spec (instruction-only) and the only code is a small shell helper script; nothing is downloaded or unpacked during install.
✓ 凭证需求
The skill requires one credential (ZAPYETI_API_KEY) and uses it solely to set the X-API-Key header when calling the ZapYeti API. The credential request is proportional and clearly justified.
✓ 持久化与权限
always is false and the skill does not request elevated or persistent system privileges or modify other skills. Autonomous invocation is allowed by default but this skill's actions are limited to API calls.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
安装命令
点击复制官方npx clawhub@latest install zapyeti
镜像加速npx clawhub@latest install zapyeti --registry https://cn.longxiaskill.com