技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.3
统计：⭐ 0 · 33 · 0 current installs · 1 all-time installs
⭐ 0
安装量（当前） 1
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：chicocifrado/whatsonchain
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill broadly matches its stated purpose (automating API key acquisition and calling Whatsonchain), but included scripts try to auto-extract user data, run browser automation/OAuth flows, and reference tools/commands that are not declared — these mismatches and automation of credentials warrant caution.
目的
Name and description (BSV API + API key management) align with the code: scripts onboard users, obtain/store API keys, and call the Whatsonchain API. However the skill metadata says no required binaries or env vars, while the runtime scripts expect tools like curl, jq, and the 'clawhub' CLI and a browser automation capability. That mismatch (declared requirements = none vs. scripts using several external tools) is inconsistent.
说明范围
SKILL.md directs users to run scripts that: attempt to extract the user's email from clawhub.ai/settings, call clawhub login, run OAuth device flows (GitHub/Google), poll token endpoints, and save access tokens and API keys to disk. These actions go beyond simple 'call an API' — they read account state and manage credentials. While these steps are related to automating setup, they can access sensitive account data and perform network interacti…
安装机制
There is no external download or installer (instruction-only), which is lower risk. The skill includes local scripts that will be placed into the workspace when installed. A mild concern: package.json defines a postinstall hook pointing to './PRESETUP.sh' which does not exist in the bundle — this appears sloppy and should be validated but isn't proof of maliciousness.
证书
The skill does not declare required env vars but the workflow reads/writes sensitive data: it saves OAuth access tokens to ~/.clawhub/oauth-token.txt and the API key to ~/.clawhub/.env (WATSONCHAIN_API_KEY) and optionally modifies ~/.bashrc. The script also attempts to extract emails from a user-specific settings page (clawhub.ai/settings). These accesses are somewhat proportional to automating onboarding, but they require handling of credenti…
持久
The skill is not always-enabled and does not request global privileges. It does create files under $HOME/.clawhub (oauth token, .env, notes) and may optionally add the API key export to ~/.bashrc. This is expected for a credentialed API helper, but users should be aware these files will persist and contain secrets.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Whatsonchain」。简介：Provides API key management and tools for querying BSV blockchain data like tra…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/chicocifrado/whatsonchain/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。