📦 Zsxq — 知识星球
v0.1.0Topic知识星球主题管理：搜索主题、查看详情、发布帖子、发表评论、回答提问、删除主题、设置精华和标签。用于用户查找内容、发帖、评论、回答问题、删除主题或管理主题。
0· 19·0 当前·0 累计
by 下载技能包
最后更新
2026/4/19
安全扫描
OpenClaw
可疑
medium confidence该技能的指令在管理 Zsxq 主题方面看似连贯，但存在重要不匹配（声明的需求 vs SKILL.md）以及缺失的认证细节，使其行为不明确且可能存在风险。
评估建议
This skill appears to be a wrapper for the zsxq-cli tool to manage 知识星球 topics, but it has important gaps you should resolve before installing:
- Verify presence and provenance of zsxq-cli on your system. The SKILL.md expects this binary, but the registry metadata does not declare it — confirm which is authoritative.
- Ask the publisher for the referenced '../zsxq-shared/SKILL.md' (it should contain authentication and security rules). Do not proceed unless you can inspect that file and confirm ...详细分析 ▾
⚠ 用途与能力
The skill is described as a Zsxq (知识星球) topic manager and its SKILL.md expects the 'zsxq-cli' binary to perform API calls — that aligns with the stated purpose. However the registry metadata lists no required binaries or credentials, and the package does not declare any auth environment variables despite doing write/delete operations. This mismatch between claim and declared requirements is unexplained.
⚠ 指令范围
Runtime instructions invoke 'zsxq-cli' for reads and destructive writes (create/reply/answer/delete) and explicitly require reading an external '../zsxq-shared/SKILL.md' for authentication and error rules. The shared SKILL.md is not included in this bundle, so the agent would need external context to authenticate. The skill properly annotates that writes are public and require confirmation, but reliance on an external, non-bundled file for auth is a scope and availability concern.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files — lowest install risk. Nothing is downloaded or written by the skill package itself.
⚠ 凭证需求
The skill performs authenticated, irreversible operations (e.g., DELETE topic, post answers that cannot be changed) yet declares no required environment variables or primary credential. Real use of zsxq-cli will require credentials (cookies/tokens). The absence of declared credentials or explanation of where/how authentication is provided is disproportionate and opaque.
✓ 持久化与权限
always is false and the skill does not request persistent or elevated platform privileges. It does not modify other skills' configs. Note: autonomous invocation is allowed (platform default) — combined with the ability to perform destructive writes this increases blast radius if auth is available.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/4/19
zsxq-topic 技能初始发布，用于管理 知识星球 主题。 - 支持搜索、查看详情、发帖、评论、回答问答、删除主题、管理精选/标签。 - 强调在执行不可逆写操作（发帖、评论、回答）前需用户确认。 - 提供常用操作快捷方式：搜索、详情、创建、回复、回答。 - 通过直接 API 调用覆盖高级操作（精选/标签管理、自问自答查询、主题删除）。 - 使用前需阅读共享的认证与错误处理文档。
● 无害
安装命令
点击复制官方npx clawhub@latest install zsxq-topic
镜像加速npx clawhub@latest install zsxq-topic --registry https://cn.longxiaskill.com