← 返回 Skills 市场
TOTP
作者
Diego Cornejo
· GitHub ↗
· v1.0.2
508
总下载
0
收藏
1
当前安装
3
版本数
在 OpenClaw 中安装
/install totp
功能描述
TOTP-based OTP verification for sensitive operations (env vars, gateway restarts, backup deletions, critical config changes). Uses otplib with window:2 (1 mi...
安全使用建议
This skill appears to do what it says, but consider these precautions before installing: (1) Keep the TOTP secret private — avoid committing .env to source control and prefer a secure secret store if available. (2) Run npm install in a controlled environment and review or vendor the two dependencies (@otplib/preset-default and qrcode) or use a lockfile to prevent supply-chain surprises. (3) After generating the QR, ensure qr.png is actually deleted and the secret rotated if it may have been exposed. (4) Confirm the agent's integration only prompts for the OTP and does not transmit the TOTP_SECRET or .env contents to external services. (5) If you need higher assurance, inspect dependency code or run the scripts locally yourself to verify behavior before granting the agent the ability to invoke them.
功能分析
Type: OpenClaw Skill
Name: totp
Version: 1.0.2
The OpenClaw TOTP skill is designed for secure OTP verification, using standard libraries like `@otplib` and `qrcode`. The `SKILL.md` instructions are clear, align with the stated security purpose, and include a critical step to immediately delete the generated `qr.png` file, which contains the TOTP secret, after it's sent to the user. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent beyond its stated security function.
能力评估
Purpose & Capability
The name/description (TOTP verification for gating sensitive operations) matches the requested resources: node binary and a single TOTP_SECRET. The scripts generate and verify TOTP secrets and tokens, which is exactly what the skill claims to do.
Instruction Scope
SKILL.md limits runtime actions to installing dependencies, generating a QR/secret, prompting for a 6-digit OTP, and running the local verify script. It does not instruct reading unrelated files or transmitting secrets to external endpoints. The instructions to delete qr.png and store TOTP_SECRET in .env are explicit and scoped to the secret onboarding flow.
Install Mechanism
No custom download/install script; runtime expects npm install which fetches two npm packages (@otplib/preset-default, qrcode). Using npm is expected for a Node skill but is a moderate-risk vector compared to instruction-only skills — however package names and pinned versions are provided and there are no obscure URLs or archive extraction steps.
Credentials
Only the TOTP_SECRET env var is required and declared as the primary credential. That single secret is necessary and proportionate for TOTP verification. The skill does not request unrelated credentials or config paths.
Persistence & Privilege
always is false and the skill contains no instructions to modify other skills or system-wide settings. It does not request persistent elevated privileges beyond the normal ability to run its verification script.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install totp - 安装完成后，直接呼叫该 Skill 的名称或使用
/totp触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
- Setup instructions now include explicitly sending the QR image (qr.png) to the user and deleting it immediately for better security.
- Google Authenticator/Authy configuration step updated to allow using either the generated secret or QR image.
v1.0.1
- No changes detected in this version.
- The skill version remains functionally identical to the previous release.
v1.0.0
- Initial release of the TOTP skill for OTP verification during sensitive operations.
- Adds secure TOTP (Time-based One-Time Password) checks for actions like environment variable access, configuration changes, gateway restarts, and backup deletions.
- Setup includes secret generation, QR code for authenticator apps, and environment variable configuration.
- Includes scripts to generate secrets and verify OTP codes with a 1-minute time window.
- Documentation provided in SKILL.md for setup, usage, and integration steps.
元数据
常见问题
TOTP 是什么？
TOTP-based OTP verification for sensitive operations (env vars, gateway restarts, backup deletions, critical config changes). Uses otplib with window:2 (1 mi... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 508 次。
如何安装 TOTP？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install totp」即可一键安装，无需额外配置。
TOTP 是免费的吗？
是的，TOTP 完全免费（开源免费），可自由下载、安装和使用。
TOTP 支持哪些平台？
TOTP 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 TOTP？
由 Diego Cornejo（@diegofcornejo）开发并维护，当前版本 v1.0.2。
推荐 Skills