技能详情（站内镜像，无评论）
作者：LIU @2019-02-18
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.7
统计：⭐ 0 · 108 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：良性
Package：2019-02-18/social-vault
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：良性
OpenClaw 评估
SocialVault's requested tools, files, and runtime behavior are consistent with a local credential vault for social accounts, but I could not fully verify the crypto/key-handling implementation and scheduled-decrypt behavior in the omitted code, so review those before trusting sensitive secrets.
目的
Name/description (social account credential manager) align with requested resources and behavior: node/npx, the OpenClaw browser tool, local filesystem access to a vault/, adapter files, and outgoing requests to official platform endpoints declared in metadata. There are no unrelated credentials or external services required.
说明范围
SKILL.md instructs the agent to create/initialize a local vault, parse user-provided cookies/tokens, use the platform browser tool for QR/login flows, and display QR screenshots in conversation. Those actions are within the described scope, but they mean the agent will (a) accept user-supplied credentials, (b) decrypt them in memory for verification, and (c) drive a browser that may capture screenshots—users should expect those operations.
安装机制
Install is standard: npm install --production and an explicit setup.sh that runs the local tsx runtime and initializes the vault. No external URL downloads, URL shorteners, or arbitrary extracts were used in the visible install spec or package.json; dependency surface is minimal (tsx).
证书
The skill requests no environment variables or unrelated credentials. It only operates on user-supplied cookies/tokens and local vault files. The hardcoded TRUSTED_DOMAINS whitelist enforces domain constraints for outgoing verification requests (as implemented in session-verifier.ts).
持久
Cron entries are declared (periodic health checks and refresh tasks) that will decrypt credentials in memory and call platform endpoints. 'always' is false, and the skill does not appear to modify other skills or system-wide settings. Nonetheless, scheduled automatic access to credentials is a sensitive capability users should be aware of.
综合结论
This skill is largely coherent with its stated purpose: it uses node/npx, local files under vault/, and the builtin browser tool to import and verify social-media credentials and schedules periodic health checks. Before installing: 1) Review the vault-crypto.ts implementation (key generation, key file permission setting, in-memory clearing) to confirm keys are created with strict permissions and plaintext is reliably zeroed/cleared. 2) Confirm…
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「SocialVault」。简介：社交平台账号凭证管理器。提供登录态获取、AES-256-GCM 加密存储、定时健康监测和自动续期。Use when managing social media…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/2019-02-18/social-vault/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。