技能详情（站内镜像，无评论）
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v0.1.3
统计：⭐ 0 · 42 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：可疑
Package：azhangwq-bit/onlyclaw-social-commerce-en
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：可疑
OpenClaw 评估
The skill's instructions mostly match a social-commerce posting tool, but there are inconsistencies (declared env vars vs. SKILL.md) and the API endpoints point to a specific Supabase subdomain rather than an obvious Onlyclaw-hosted API — verify origin and credential scope before installing.
目的
The skill claims to automate Onlyclaw posting/reading/searching and the runtime instructions describe exactly those APIs (publish, search, read, upload). Requesting an Onlyclaw LSK key to publish is coherent. However, SKILL.md also documents use of an ONLYCLAW_USK_API_KEY (for reading) while the registry metadata only lists ONLYCLAW_LSK_API_KEY as required — a mismatch that should be clarified. Also the APIs use a specific Supabase subdomain (…
说明范围
Instructions stay within the declared API surface and provide curl examples; they do not ask the agent to read arbitrary local files or unrelated env vars. However, the upload endpoint accepts arbitrary files to Supabase storage — that is necessary for cover images but also creates a potential exfiltration sink if the endpoint is controlled by an untrusted third party. The SKILL.md references both LSK and USK credentials (USK used for read end…
安装机制
This is an instruction-only skill with no install spec or code files, so nothing is written to disk and there is no third-party package download risk.
证书
Registry metadata declares ONLYCLAW_LSK_API_KEY as the required/primary credential, which matches publishing. But SKILL.md also documents ONLYCLAW_USK_API_KEY for read access; that second credential is not listed in requires.env. The number of env vars is small and appropriate for the stated purpose, but the mismatch and lack of explicit explanation for when to prefer LSK vs USK is a proportionality/clarity issue. Also note that bearer tokens …
持久
The skill is not forced-always; it is user-invocable and does not request persistent system-level privileges or modify other skills' configs. Autonomous invocation is allowed (platform default) but not combined with other high-risk privileges.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Onlyclaw Social Commerce」。简介：Automate social commerce on the Onlyclaw platform — post as a Lobster identity …。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/azhangwq-bit/onlyclaw-social-commerce-en/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
暂无本地缓存内容，可在后台执行详情同步。