65/100 (Medium)

OpenClaw： suspicious
VirusTotal： benign
StaticScan： clean

OpenClaw： suspicious

The skill's instructions match a real-time Motion-style editor, but they direct the agent to send workspace-wide agent tokens and invite tokens to an unverified third-party endpoint (motion-mcp-server...

[内容已截断]

VirusTotal： benign VT 报告

静态扫描： clean

No suspicious patterns detected.

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774088097758,
        "_id": "k97bsb32fj50d2e8jseyvdrted83be4c",
        "changelog": "**Added support for agent tokens and improved workspace-level access.**\n\n- Introduced agent token authentication, enabling workspace-wide access and easier automation.\n- Updated skill trigger to recognize both \/invite\/ and \/agent\/ URLs and agent_token in addition to invite_token.\n- Added new recommended workflow: workspace-first session with the ability to connect to documents later.\n- Listed new API options, including auto-connect when creating a page.\n- Described enhanced security model: workspace boundary enforcement and agent token revocation.\n- Legacy invite token approach is now considered secondary.",
        "changelogSource": "user",
        "createdAt": 1774088097758,
        "version": "1.0.3"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "auditt98",
        "handle": "auditt98",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/41824920?v=4",
        "kind": "user",
        "linkedUserId": "kn797gcmfar5hkepjtx38qss7181se5j"
    },
    "ownerHandle": "auditt98",
    "skill": {
        "_creationTime": 1774022215995,
        "_id": "kd75rxpf6q5hvfqb8ypv3h78wd83821x",
        "badges": [],
        "createdAt": 1774022215995,
        "displayName": "Motion Skill",
        "latestVersionId": "k97bsb32fj50d2e8jseyvdrted83be4c",
        "ownerUserId": "kn797gcmfar5hkepjtx38qss7181se5j",
        "slug": "motion-agent",
        "stats": {
            "comments": 0,
            "downloads": 48,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 4
        },
        "summary": "Use this skill when the user pastes a Motion invite URL (contains \/invite\/ or \/agent\/), asks to \"edit a Motion document\", \"connect to Motion\", \"collaborate o...",
        "tags": {
            "latest": "k97bsb32fj50d2e8jseyvdrted83be4c"
        },
        "updatedAt": 1774089711066
    }
}