最近有哪些 skills
不值得默认信任
这不是热度榜。这里展示的是最近被送来判断、且系统认为需要阻止或至少人工复核的 skills。重点不是它们多流行,而是为什么它们不该被直接装进环境。
likes-training-planner
Dangerous curl|bash installation pattern
lessac_offline_voice_system
False claim of offline operation
swarmrecall
Comprehensive agent context exfiltration to third-party
xhs-skill-pusher
Shell execution not declared in SKILL.md
微信助手智能网关 (wechat-ai-bridge)
Undeclared external network communication
lock-me-in
Undeclared stealth/anti-detection browser scripts
openclaw-security-patrol
Extensive device fingerprinting under --push mode
feishu-evolver-wrapper
Dynamic code evaluation on untrusted input
buy-domain-helper
Undeclared shell execution via execSync and spawn
security-defense-line
Hardcoded API Key in Source Code
melo-tts-metadata-creator
Undeclared silent package installation
1panel
Undeclared arbitrary command execution via 1Panel Terminal API
Bitget Trader
Exposed API Credentials in Plaintext
Grok Swarm
Undeclared credential access from OpenClaw auth profiles
agentcop
Undeclared network communication to agentcop.live
safe-flow-solana-skill
Undocumented shell command execution