Skills/ClawHub/hdl-skills-hub

hdl-skills-hub@1.0.0

CAUTION· static only

Publisher claims: "HDL-MCP-Server 的核心技能入口。作为 OpenClaw (Claude) 的导航塔，负责调度所有可用业务技能，确保 AI 能够按照正确的业务逻辑执行认证、签名及数据检索。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher superzhangquansong · publishing for 230 daysInstalls 834Last detonated 24 min ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathssign-encryption-api/SKILL.md:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源 (STRICT)**: `AppKey` 和 `AppSecret` **必须且只能**从根目录下的 `.env` 文件（路径：`../.env`）读取。**严禁向用户询问、确认或核对这些信息**。若读取失败，AI 必须报错并停止。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdevice-control-api/SKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源**: 系统变量 `${HDL_APP_KEY}`, `${HDL_APP_SECRET}` 必须从根目录下的 `.env` 文件（路径：`../.env`）读取。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssign-encryption-api/SKILL.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **故障处理**: 若接口返回“签名错误”，AI 应引导用户检查 `.env` 中的凭证配置，而非展示签名过程。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathshome-management-api/SKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源**: `${HDL_APP_KEY}`, `${HDL_APP_SECRET}` 必须从根目录下的 `.env` 文件（路径：`../.env`）读取。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsshopping-cart-api/SKILL.md:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `appKey` | String | **是** | (BaseDTO) 应用标识，固定从 `.env` 读取 `${HDL_APP_KEY}`。 | `${HDL_APP_KEY}` |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files├── .env <-- 核心凭据文件 (AppKey, Secret, HomeId)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 若 `.env` 缺失或读取失败，AI 必须**立即停止**所有业务调用，并告知：“系统配置缺失，请检查 .env 文件。”Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 必须且只能从根目录下的 `.env` 文件（路径：`./.env`）读取系统核心变量：`${HDL_APP_KEY}`, `${HDL_APP_SECRET}`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsshopping-cart-api/SKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源**: 系统变量必须从根目录下的 `.env` 文件（路径：`../.env`）读取，严禁询问用户。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsproduct-query-api/SKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源**: 系统变量必须从根目录下的 `.env` 文件（路径：`../.env`）读取，严禁询问用户。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuser-auth-api/SKILL.md:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **凭据源 (STRICT)**: 所有系统凭据（AppKey, ApSecret）必须且只能从根目录下的 `.env` 文件（路径：`../.env`）读取。**严禁向用户询问这些信息**。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuser-auth-api/SKILL.md:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files6. **AI**: (自动结合 .env 中的 AppKey/Secret 登录成功) -> “登录成功！正在为您查询方悦面板... ✅”Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **房屋 ID (homeId) 动态获取**: 严禁在 `.env` 中硬编码 `homeId`。AI 必须在执行设备控制前，先通过 **[房屋管理 (home-management-api)](./home-management-api/SKILL.md)** 获取用户当前的房屋列表及其对应的 `homeId`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssign-encryption-api/SKILL.md:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files在拼接好的字符串末尾，直接追加从 `.env` 读取的 `${HDL_APP_SECRET}`。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈7,215 tok
8 files · 9 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim superzhangquansong: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim superzhangquansongPropose a patch to the maintainer