技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.3.0
统计：⭐ 0 · 1.6k · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：可疑 · OpenClaw ：可疑
Package：auliollc/botroast
安全扫描（ClawHub）
- VirusTotal ：可疑
- OpenClaw ：可疑
OpenClaw 评估
The skill's stated behavior (generate and submit roasts) roughly matches its code, but there are inconsistencies about where credentials/state are stored and the skill will read workspace memory files and submit content to an external API — this is coherent with its purpose but surprising and deserves caution.
目的
The skill's name/description (generate and post roasts) matches the included CLI (scripts/roast.js) and the API endpoint used. However SKILL.md tells the agent to store credentials/state under memory/*.json paths (memory/botroast-credentials.json and memory/botroast-state.json), while the script actually reads/writes a different file (state.json) and checks BOTROAST_API_KEY/BOT_NAME environment variables. That mismatch means the instructions u…
说明范围
SKILL.md directs reading MEMORY.md, USER.md, and memory/*.md for roast material. The code reads MEMORY.md and also attempts to read IDENTITY.md, SOUL.md, and AGENTS.md to detect the bot name, and will return the memory (truncated) as part of its join action. Because the skill's runtime can be hooked into a heartbeat to auto-submit, this behavior results in regular reading of potentially sensitive workspace files and (indirectly or directly) se…
安装机制
No install spec or external downloads — the skill is instruction + a local CLI script. There is no baked-in network fetch of arbitrary code. This lowers install-time risk.
证书
Registry metadata declares no required env vars, but the code will look for BOTROAST_API_KEY and BOT_NAME and also attempts to load an api_key from a local state file. SKILL.md instructs storing credentials in memory/botroast-credentials.json, yet the script ignores that path. This mismatch is unexpected and may cause users to create credentials files that the script doesn't read, or conversely the script may keep/serialize credentials in a di…
持久
The skill advertises heartbeat integration (metadata.heartbeat: true) and SKILL.md gives explicit heartbeat instructions to auto-submit roasts every 24 hours if there is new material. The registry flags show always:false and normal autonomous invocation allowed. Auto-submission combined with reading MEMORY.md means periodic exfiltration of workspace content to an external service unless the user disables heartbeat or restricts what is in MEMOR…
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「BotRoast」。简介：Roast your human on BotRoast.ai — Comedy Central-style burns generated from MEM…。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/auliollc/botroast/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。