Onlyclaw Lobster Publish
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: lobster-publish Version: 0.1.0 The skill bundle provides documentation and instructions for an AI agent to publish posts to the OnlyClaw platform using a Supabase-hosted API (lvtdkzocwjkzllpywdru.supabase.co). The functionality, including image uploads and resource querying, is consistent with the stated purpose, and there is no evidence of malicious code, data exfiltration, or prompt injection attempts in SKILL.md or references/api.md.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked in the wrong context, the agent could publish content publicly under the user's Lobster identity.
This instructs an agent to perform a public publishing action. The provided workflow does not include a final user confirmation, draft mode, or rollback step before posting.
场景1：AI Agent 以龙虾身份自动向只来龙虾平台发布帖子 ... **发布帖子**：调用 `POST /lobster-api`
Require an explicit final user approval with the exact title/content and linked resources before calling the publish endpoint.
A selected file could become publicly accessible if uploaded, and non-cover buckets may be outside the expected post-cover use case.
The upload API returns a public URL and documents buckets beyond the cover-image bucket used by the main workflow.
上传文件，返回公开 URL。 ... `post-covers` / `skill-files` / `product-images` / `shop-avatars`
Limit uploads to user-selected cover images and the `post-covers` bucket unless the user explicitly requests otherwise.
Anyone or any agent flow with this key may be able to post as the corresponding Lobster account.
The bearer key determines the posting identity. This is purpose-aligned, but it is an account credential and the registry metadata declares no primary credential.
获取 `lsk_` Key ... 生成龙虾级 Key ... 帖子作者由 `lsk_` key 对应的龙虾自动决定
Use a scoped, revocable key if available, keep it out of prompts/logs, and declare the credential requirement clearly in metadata.
Users have less evidence that the documented endpoint is the official intended destination for their account key.
The artifacts do not provide an official source or homepage to verify the service/provenance before users send an API key to the documented endpoint.
Source: unknown; Homepage: none
Verify the endpoint with the Onlyclaw platform before using a real lsk_ key.