tc-protohub

在 ProtoHub 上管理原型。当用户想要上传目录或 ZIP 文件作为原型、更新现有原型、列出原型或获取预览链接时，请使用此技能。它支持自动打包文件夹、强制校验入口文件 (index.html)，以及按名称搜索原型以便更新。

This skill appears to do what it claims (package/validate and upload prototypes), but the registry metadata omits required environment variables that the SKILL.md insists are mandatory — that mismatch is a red flag about packaging quality or tampering. Before installing or running it: 1) confirm the PROTOHUB_API_KEY and PROTOHUB_URL values and ensure the API key has limited scope (only prototype uploads) and can be revoked; 2) verify the owner/source (no homepage provided) or inspect the publish.py contents yourself (it’s included) to ensure there are no hidden endpoints; 3) only point PROTOHUB_URL at a trusted server — if you set it to a remote host, the script will upload the zipped files you give it to that server; and 4) ask the publisher/registry to update the metadata to declare the required env vars to remove the inconsistency. If you want higher assurance, run the script in an isolated environment and review network traffic to confirm uploads go where you expect.

Type: OpenClaw Skill Name: tc-protohub Version: 1.0.1 The tc-protohub skill is a legitimate utility for managing web prototypes on a ProtoHub server. The core logic in scripts/publish.py facilitates packaging local directories into ZIP files and uploading them to a configured API endpoint (defaulting to localhost:48080). The skill includes proper validation for entry files (index.html), handles authentication securely via environment variables (PROTOHUB_API_KEY), and lacks any indicators of data exfiltration, unauthorized execution, or malicious intent.