技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.7
统计：⭐ 0 · 1.3k · 2 current installs · 2 all-time installs
⭐ 0
安装量（当前） 2
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：aphobiacat/aibtc
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill is coherent with its stated purpose (starting/stopping a crypto-miner) but executes remote code at runtime via npx, detaches a persistent background miner, and lacks integrity checks — these behaviors are risky and warrant caution before installing.
目的
The name/description match the implementation: handler.js maps run/stop/status to managing an aibtc-worker process. There are no unrelated required env vars or config paths. The runtime behavior (spawn a miner process, detect PID) is consistent with the documented purpose.
说明范围
The instructions and handler spawn an npx process to fetch and execute the 'aibtc-worker' package, ignore its output, detach it to run in the background, and write a local state file (aibtc-worker.json). The code uses ps+grep to find processes and uses process.kill(-pid) (sending to a process group), and does not perform integrity checks on the fetched code or validate inputs. SKILL.md itself warns antivirus may flag npx fetching — the skill's…
安装机制
There is no bundled install spec, but handler.js executes 'npx --yes aibtc-worker ...' at runtime. Using npx fetches and runs code from the npm registry (network fetch + execute) without pinning a version or verifying source. This is effectively remote code execution and is high-risk (no pinned package/version, --yes suppresses prompts).
证书
The skill requests no environment variables or credentials, which is proportionate. However it writes the provided address to a local JSON state file in the current working directory (aibtc-worker.json) and leaves a detached miner process running that consumes CPU. The address and PID are stored unencrypted on disk — users should be aware of local persistence/privacy implications.
持久
The handler detaches the spawned npx miner so it continues running after the agent exits. That gives the skill ongoing resource usage and persistence on the host. Combined with autonomous invocation (allowed by platform defaults), this increases blast radius: an agent could start a long-running miner without further prompts. The stop routine uses process.kill(-pid) which targets process groups and can be more disruptive than killing a single pid.
handler.js:23
Shell command execution detected (child_process).
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「aibtc」。简介：Manage aibtc-worker automation tasks. Use this skill when the user wants to sta…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/aphobiacat/aibtc/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。