37/100 (High)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： suspicious

OpenClaw： suspicious

The skill is an API client that mostly does what its description says, but the registry metadata omits the required OPENCLAW_API_KEY (and related env info) declared in SKILL.md and used by the code — ...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： suspicious

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774120170732,
        "_id": "k97a9c0kx7fty62jyr1egt4sxx83b1br",
        "changelog": "Add env var declarations and security metadata to resolve ClawHub scanner flags",
        "changelogSource": "user",
        "createdAt": 1774120170732,
        "parsed": {
            "clawdis": {
                "author": "fstandhartinger",
                "envVars": [
                    {
                        "description": "Bearer API key created from the OpenClaw account page. Scoped to the authenticated user's instances.",
                        "name": "OPENCLAW_API_KEY",
                        "required": true
                    },
                    {
                        "description": "Base URL of the OpenClaw as a Service API. Defaults to the production endpoint.",
                        "name": "OPENCLAW_API_BASE_URL",
                        "required": false
                    },
                    {
                        "description": "Target instance ID. When omitted, the skill auto-discovers the first ready instance owned by the API key holder.",
                        "name": "OPENCLAW_INSTANCE_ID",
                        "required": false
                    }
                ]
            }
        },
        "version": "0.1.1"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "Florian Standhartinger",
        "handle": "fstandhartinger",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/1905188?v=4",
        "kind": "user",
        "linkedUserId": "kn7bxdk03rqzrt84ygwhx5whcs839mqe"
    },
    "ownerHandle": "fstandhartinger",
    "skill": {
        "_creationTime": 1774034088219,
        "_id": "kd77cw6qqmgkcryehy421dxk6h838h0r",
        "badges": [],
        "createdAt": 1774034088219,
        "displayName": "OpenClaw API Control",
        "latestVersionId": "k97a9c0kx7fty62jyr1egt4sxx83b1br",
        "ownerUserId": "kn7bxdk03rqzrt84ygwhx5whcs839mqe",
        "slug": "openclaw-api-control",
        "stats": {
            "comments": 0,
            "downloads": 62,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 2
        },
        "summary": "Control a hosted OpenClaw instance through the OpenClaw as a Service API. Use when the user asks to talk to OpenClaw over API, send a folder or file to OpenC...",
        "tags": {
            "latest": "k97a9c0kx7fty62jyr1egt4sxx83b1br"
        },
        "updatedAt": 1774120312337
    }
}