自动检测 Clash 代理健康状态，优先区域节点优选，故障时切换到最佳节点，支持手动和区域快速切换。

This package mostly does what it says (checks proxy health and uses Clash's API to switch nodes), but take these precautions before installing or enabling it: - Treat CLASH_SECRET as sensitive. Do not keep any real API secret hard-coded in scripts; replace or remove the hard-coded value in the provided shell files before use. Prefer setting CLASH_SECRET via secure agent/secret storage. - Update the registry metadata / skill config to declare CLASH_API and CLASH_SECRET so the platform can surface required secrets to you. Right now the registry lists none, which is misleading. - Review and, if needed, restrict where logs and state files are written (scripts log to /var/log/clash-switch.log and /tmp). Ensure those files are stored with appropriate permissions so secrets are not leaked. - Be aware health checks contact external endpoints (Telegram, Google, Anthropic, OpenAI, GitHub) through your proxy. This is normal for connectivity testing but you may prefer to reduce the set of test targets or confirm that contacting them is acceptable in your environment. - The package requires the Python requests library if you use the Python skill file—install it in a controlled environment. Run the scripts locally first and inspect behavior before integrating into automated Cron/agent schedules. - If you plan to run the skill autonomously (periodic cron/heartbeat), limit frequency and review every action it takes; automatic switching changes network routing and could have operational impact. If the author can (a) remove the hard-coded secret, (b) declare required env vars/primary credential in registry metadata, and (c) document the exact external network calls and log paths, the inconsistencies would be resolved and confidence would increase.

Type: OpenClaw Skill Name: clash-auto-switch Version: 1.0.2 The skill bundle provides automated Clash proxy switching and health monitoring. While the functionality aligns with its stated purpose, the scripts 'clash-switch-v2.sh' and 'clash-switch.sh' contain a hardcoded API secret ('6434ff5a-5b0f-4598-99ec-83ca96c77167'), which is a significant security vulnerability. Additionally, 'clash-switch-v2.sh' attempts to write logs to '/var/log/clash-switch.log', a high-privilege directory. Although no clear evidence of malicious intent or data exfiltration was detected, the combination of hardcoded credentials and network routing manipulation warrants a suspicious classification.