← 返回 Skills 市场
380
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install sixtyfour-skill
功能描述
People and company intelligence via the Sixtyfour AI API. AI research agents that read the live web — not static databases — to return structured, confidence...
安全使用建议
This skill is coherent with its stated purpose (people/company enrichment) but has some red flags to consider before installing:
- Missing declared credential: The SKILL.md requires an API key (SIXTYFOUR_API_KEY) but the registry metadata does not declare any required env vars or a primary credential. Ask the publisher to add SIXTYFOUR_API_KEY to the skill's declared requirements so your agent can surface the permission request and you can audit it.
- Privacy / webhook risk: Async jobs can POST results to any webhook_url you supply. Those results may contain personal emails and phone numbers. Only configure trusted webhook endpoints and verify legal/privacy compliance (e.g., GDPR) before sending PII to third parties.
- Origin verification: The skill's source is listed as unknown and homepage is missing. Verify that sixtyfour.ai is the legitimate provider (check their docs and contact points) and confirm the publisher identity before trusting API keys or installing into production agents.
- Billing & scope: The docs show per-email/phone costs and free-tier limits. Test with a disposable/test API key or account and monitor usage to avoid unexpected charges.
- Operational controls: If you want tighter control, restrict the skill to manual/user-invocable only (avoid autonomous runs), and consider using a dedicated API key with limited quota/permissions.
If the publisher provides corrected metadata (declaring the API key) and you confirm the upstream service and privacy posture, the skill's behavior is consistent with its purpose; until then proceed cautiously.
功能分析
Type: OpenClaw Skill
Name: sixtyfour-skill
Version: 1.0.0
The skill is classified as suspicious due to the use of `npx -y sixtyfour-mcp` in the `SKILL.md` and `README.md` files for setting up the MCP server. While `npx` is a common way to run CLI tools, it introduces a supply chain risk: if the `sixtyfour-mcp` npm package were compromised, it could lead to arbitrary code execution on the agent's host, with access to the `SIXTYFOUR_API_KEY`. This represents a significant vulnerability rather than direct malicious intent within the skill bundle itself.
能力评估
Purpose & Capability
The SKILL.md and README clearly describe a people/company enrichment API (Sixtyfour.ai) and show curl examples that require an API key (x-api-key / SIXTYFOUR_API_KEY). However, the registry metadata lists no required environment variables or primary credential. That mismatch (the skill needs a secret but doesn't declare it) is an incoherence and should be fixed; otherwise installers may not realize they'll need to provide a sensitive API key or how it's used.
Instruction Scope
Instructions are mostly scoped to calling the external Sixtyfour API (enrich-lead, find-email, find-phone, workflows, async jobs, webhooks). They do not instruct reading local files or unrelated env vars. Two items to note: (1) async endpoints support arbitrary webhook_url values, which can forward enriched results (including emails/phones) to any external endpoint — this is expected for such APIs but is a privacy/exfiltration risk if misconfigured; (2) the SKILL.md instructs sign-up via Google and API key export, but that API key requirement was not declared in metadata.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute, so it does not install binaries or pull external archives. README mentions helper commands (clawhub, npx sixtyfour-mcp) but no install script is included in the package — lower install risk. Confirm that your agent platform does not auto-fetch the 'npx sixtyfour-mcp' package based on the README.
Credentials
The skill requires a single API key at runtime (SIXTYFOUR_API_KEY / x-api-key) per its examples, which is proportionate for an external API integration. However, the metadata omits declaring this required environment variable/primary credential. That omission prevents automated permission prompts and auditing of required secrets. No other credentials are requested, which is appropriate.
Persistence & Privilege
The skill does not request persistent/always-on presence (always: false) and does not modify other skills. It uses standard async webhooks and polling mechanisms. Autonomous invocation is allowed (disable-model-invocation: false) which is normal; consider restricting autonomous use if you want to limit agent-initiated lookups because the skill can query PII on demand.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install sixtyfour-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/sixtyfour-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Sixtyfour-skill 1.0.0 — initial release
- Provides company and people enrichment via the Sixtyfour AI API, focused on live web research (not static databases).
- Supports endpoints for lead and company enrichment, email and phone finding, lead scoring, natural language and filter-based search, and batch workflows.
- Returns structured, confidence-scored data with customizable fields.
- Offers both synchronous and asynchronous API support with sample payloads, response formats, and setup documentation.
- Targets users needing accurate, up-to-date people/company data for lead enrichment, research, and outreach.
元数据
常见问题
Sixtyfour Skill 是什么？
People and company intelligence via the Sixtyfour AI API. AI research agents that read the live web — not static databases — to return structured, confidence... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 380 次。
如何安装 Sixtyfour Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install sixtyfour-skill」即可一键安装，无需额外配置。
Sixtyfour Skill 是免费的吗？
是的，Sixtyfour Skill 完全免费（开源免费），可自由下载、安装和使用。
Sixtyfour Skill 支持哪些平台？
Sixtyfour Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Sixtyfour Skill？
由 rxhxm（@rxhxm）开发并维护，当前版本 v1.0.0。
推荐 Skills