Openclaw Quickstart Cn

中文用户快速安装配置国产AI模型并测试OpenClaw全流程指导，包括环境检查、模型配置、连接测试及扩展技能安装。

This guide appears to be a legitimate quickstart for configuring Chinese AI providers, but it recommends running a remote installer via 'curl | bash' which can execute arbitrary code on your machine. Before proceeding: (1) verify the installer URL (get.openclaw.ai) — check the project's official repo or homepage and confirm the install script's contents; (2) prefer the npm install path if you trust the package registry and maintainers; (3) if you must use the curl method, download the script first and inspect it (curl -fsSL https://get.openclaw.ai -o install.sh; less install.sh) instead of piping to sh; (4) run installs in a sandbox or VM if you are unsure; (5) only provide API keys for the listed providers and never share cloud or system credentials; (6) verify the homepage/repo (skill.json points to https://github.com/openclaw-cn/skills) and the publisher identity before trusting the installer. If you want, I can fetch and summarize the installer script or check the GitHub repo for matching installer sources (I will not execute any code).

Type: OpenClaw Skill Name: openclaw-quickstart-cn Version: 1.0.1 The skill bundle contains a high-risk 'curl | bash' installation pattern in SKILL.md (targeting https://get.openclaw.ai), which is a common vector for remote code execution. Additionally, the instructions prompt users to input sensitive API keys for multiple AI providers into the CLI, which could be captured if the environment or the downloaded script is compromised. While these behaviors align with the stated purpose of a quickstart guide, the lack of checksums or verification for the remote payload makes it a significant security risk.