技能详情（站内镜像，无评论）
作者：Tresser @0xtresser
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 191 · 1 current installs · 1 all-time installs
⭐ 0
安装量（当前） 1
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：0xtresser/web-skills-protocol
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill does what it says (discover and follow website-published SKILL.md files) and requires no credentials, but it empowers the agent to fetch and execute third-party instructions—there's a real prompt-injection/data-exfiltration risk that isn't mitigated by the skill itself.
目的
The name/description match the actual instructions: the skill only describes discovering /skills.txt or /agents.txt and fetching SKILL.md files to drive site-specific interactions. No unrelated binaries, env vars, or installs are required.
说明范围
The runtime instructions require the agent to fetch and follow arbitrary remote SKILL.md files and act on them. That is necessary for the stated purpose, but it also means any website can serve instructions the agent will follow. The SKILL.md content becomes an execution surface and can contain adversarial directives (prompt-injection). The skill text does include sensible guardrails (respect robots.txt; ask user for auth) but does not specify…
安装机制
There is no install specification in the registry entry (instruction-only). The README shows optional curl-based install examples from raw.githubusercontent.com (a well-known host) — that is traceable. No archive downloads or obscure URLs are required by the skill itself.
证书
The skill declares no environment variables, credentials, or config-path access (proportionate). However, by design it will surface SKILL.md files that may request authentication or credentials for the target site; the SKILL.md instructs the agent to ask the user before using creds, but the skill does not enforce or validate that flow, creating a social-engineering risk.
持久
The skill is not always-enabled, is user-invocable, and the registry flags are default. It does not request permanent privileges or modify other skills/config. No elevated persistence is requested.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「web-skills-protocol」。简介：Auto-discover and use Web Skills Protocol (WSP) skills when interacting with we…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/0xtresser/web-skills-protocol/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。