DeepMiner Skills
v1.4.0通过 dm-cli 命令行工具与 DeepMiner (DM) 系统交互。**凡是涉及 DM/DeepMiner 系统的任务，必须先读此 Skill。** 触发条件：用户提到 "使用 DM"、"发给 DM"、"用 DM 问一下"、"DM 帮我..."、"DeepMiner 执行..." 等任何涉及 DM 系统的任...
⭐ 0· 148·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the implementation: SKILL.md and the included scripts all operate via dm-cli and orchestration primitives (sessions_spawn/sessions_send/message). The instructions, helper scripts, and response-parsing reference only DeepMiner concepts and platform notification tools, so requested capabilities are appropriate for the stated goal. Minor note: SKILL.md instructs configuring an AccessKey via dm-cli but the registry metadata does not declare any required environment variable or primary credential — the key is expected to be stored/configured by dm-cli rather than passed via env vars.
Instruction Scope
Instructions require passing user prompts unmodified to the external DeepMiner system and returning DM's last_messages verbatim; this is coherent with the purpose but creates a privacy/data-leak surface (any secrets in user prompts will be sent to DeepMiner). The skill also mandates use of subagents (sessions_spawn) and relies on sessions_send/message to notify the main session — these are platform-specific but expected for non-blocking polling. Scripts parse and forward full DM result JSON including metadata and file URLs; this is intended but worth noting for data sensitivity.
Install Mechanism
No install spec in the registry (instruction-only skill). The SKILL.md recommends npm install -g deepminer-cli; that is a normal public-registry installation instruction. The included scripts are plain shell scripts — no remote downloads or extract operations are performed by the skill itself. Overall install footprint is low and traceable, but users should vet the npm package prior to installation.
Credentials
The skill does not declare any required env vars, yet it requires a DeepMiner AccessKey to be configured in dm-cli. This is explainable (dm-cli stores config locally) but the registry metadata omits explicit credential requirements. Scripts call sessions_send/message and will surface DM result JSON (including metadata fields like trace_id/worker_name) and external file URLs; forwarding of these artifacts to the agent/chat is expected but may expose sensitive info. No unrelated credentials or system config paths are requested.
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system-wide agent settings. Scripts write per-invocation status files at locations supplied by the caller, which is normal for polling helpers. No elevated or persistent privileges are requested.
Assessment
This skill appears to do what it says: it uses dm-cli and background polling scripts to submit tasks to DeepMiner, poll for status, and post results back into the chat. Before installing or using it: 1) Do not include secrets in prompts — SKILL.md explicitly requires forwarding the user prompt verbatim to DeepMiner, so anything you send will go to the external service. 2) The dm-cli AccessKey will be configured/stored by dm-cli (not declared as an env var here) — treat that key like any secret and verify where dm-cli stores it. 3) Verify the npm package 'deepminer-cli' and the external endpoints you will contact (examples in docs reference domains like dm-test.xmingai.com and clawhub.ai) to ensure they are the expected/official services. 4) The scripts will surface DM response JSON and file URLs into the chat (including metadata such as trace_id, worker_name); review whether those artifacts may contain sensitive data. 5) If you need stricter privacy, avoid sending anything sensitive to DeepMiner or run these tools in an environment you control. If you want, I can list the exact commands the skill will run and where data flows to help you decide.Like a lobster shell, security has layers — review code before you run it.
latestvk97cb58kz84tp4ww33vqqf9zz584skdf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.