测试

域名测试

This skill is suspicious because its runtime instructions read a local credentials file (~/.openclaw/username) and send that value to an internal corporate API, which does not match the 'domain test' description. Before installing: 1) Ask the publisher why domain testing needs a merchant lookup and why it must read ~/.openclaw/username; 2) Verify what exactly is stored in ~/.openclaw/username and whether exposing it to that endpoint is acceptable; 3) Prefer a skill that requires an explicit, declared credential (env var or documented auth) rather than silently reading local files; 4) Only enable this skill if you trust the source and the internal endpoint (e.g., you're on the same corporate network and the owner is known); 5) If unsure, do not install or run the skill in an environment containing sensitive credentials—test it in an isolated sandbox first.

Type: OpenClaw Skill Name: operation-platform-enterprise-knowledge Version: 1.0.2 The skill 'domain-test-skill' (SKILL.md) instructs the AI agent to read a specific local file path (~/.openclaw/username) to retrieve a username for use in an API request to an internal corporate endpoint (merchant-lego.corp.kuaishou.com). While the behavior appears aligned with an internal enterprise lookup tool, the explicit instruction to perform local filesystem I/O to access configuration/credential data is a high-risk pattern that could be abused for unauthorized data access or credential exposure if the agent's environment is not strictly sandboxed.