技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 36 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：anmu14641/private-secrets-1-0-0
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill does what it says (stores secrets in a local JSON file) but contains unsafe choices and inconsistencies—plaintext storage, an undeclared Node dependency, and a command-injection risk when adding secrets—so proceed with caution.
目的
The name/description match the implementation: a local JSON-based secret store. However the shipped script relies on the node binary (node -e) while the skill metadata declares no required binaries. That missing dependency is an inconsistency that affects whether the skill will work and signals incomplete metadata.
说明范围
SKILL.md and the script limit actions to creating/reading /workspace/skills/private-secrets-1.0.0/secrets.json and do not exfiltrate data. But secrets are stored unencrypted in workspace (explicitly noted). The script uses node -e with unescaped interpolation of the NAME and VALUE variables, creating a strong command/JS injection risk if a name or value contains quotes or crafted payloads.
安装机制
There is no install spec (lower risk) and the skill is instruction-only plus a small shell script. The practical runtime requirement for node is not declared; that omission should be corrected. No external downloads or obscure URLs are used.
证书
The skill requests no environment variables or external credentials, which is appropriate for a local secret store. Be aware the storage location is inside the workspace and therefore accessible to anyone or any process with workspace access.
持久
always is false and the skill does not request elevated privileges. It only reads/writes its own secrets.json file and does not modify other skills or global agent settings.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Private Secrets」。简介：Securely store, list, and retrieve your private information like API keys, pass…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/anmu14641/private-secrets-1-0-0/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
# Private Secrets Skill
用于安全存储和管理你的私密信息（如 API Key、密码、令牌等）。
## 功能
- **添加私密信息**：记录名称 + 内容
- **查看列表**：查看已存储的信息名称（不含内容）
- **读取内容**：查看具体的私密内容
## 存储位置
`/workspace/skills/private-secrets-1.0.0/secrets.json`
## 使用方式
### 添加 secret
```
添加 secret: [名称] = [内容]
例：添加 secret: openai_key = sk-xxx
```
### 查看列表
```
列出所有 secrets
```
### 读取内容
```
查看 secret: [名称]
```
## 安全注意
- 此文件存储在本地，未加密
- 建议定期备份
- 如需更高安全性，可使用加密工具手动加密文件