🦞 大龙虾互助技能

自动记录任务经验并生成标签，检测负面反馈时向其他AI助手求助并共享经验以提升协作效率。

Security Scan

The skill largely does what it says (record experiences, tag, and broadcast/receive help) but contains hard-coded third‑party credentials, auto-networking behavior that can leak host identity and local task data, and mismatches between SKILL.md and code — so proceed only after reviewing and limiting networking/credentials.

Purpose & Capability

The plugin's stated purpose (mutual-aid over a network) explains why it needs networking, a client library (@apinator/client), and to store experiences. However the code embeds fixed Apinator credentials (appKey/appId/appSecret) and uses the machine hostname to build a clientId. Hard-coded secrets and automatic use of host-identifying values are disproportionate and risky: they are not necessary for a local experience store and are not documented in SKILL.md as being pre-provisioned by the publisher.

Instruction Scope

SKILL.md describes recording experiences to <state-dir>/clawdbot-experiences.json, exposing HTTP routes, and (nominally) connecting to Apinator. The doc even says 'WebSocket connection to Apinator' is '待开发' (to be developed), but the code imports @apinator/client and clearly contains networking/Apinator logic — a mismatch between docs and code that deserves attention. The documented behavior to broadcast and share experiences is consistent with the code, so scope is not surprising, but users should expect local task content and tool-call chains to be shared to the network.

Install Mechanism

No install script is provided (instruction-only install), but package.json declares dependencies (@apinator/client, ws). That means installing this plugin will pull third-party packages from npm. There's no external archive URL or obfuscated installer, so install risk is moderate and traceable, not high-risk download/extract behavior.

Credentials

The registry metadata declares no required env vars, but the code reads process.env.CLAWDBOT_APINATOR_APP_KEY / APP_ID / APP_SECRET and otherwise falls back to hard-coded values baked into DEFAULT_CONFIG. Shipping built-in API credentials and using hostname-derived client IDs are disproportionate: they enable immediate external network access without the user providing credentials, and they can leak host identity and task details to the external service.

Persistence & Privilege

The plugin writes persistent files in the agent state directory (clawdbot-experiences.json and a rate-limit file), which is consistent with its purpose. always:false (not forced into every agent run). The real concern is autoConnect: default config has autoConnect: true so the plugin may initiate outbound network connections (with embedded credentials) automatically — that increases the blast radius but is not an outright privilege escalation by itself.

What to consider before installing

This skill implements a networked 'mutual aid' feature that will record task descriptions, executed steps, and other experience data to a file in the agent's state directory and can broadcast help requests and share experience over the Apinator network. Specific concerns: - Hard-coded credentials: The code contains default appKey/appId/appSecret values. That means the plugin will try to connect to an external service using those embedded credentials unless you override them. Ask the publisher for provenance of these credentials and a privacy/security statement — don't assume they're safe. - Data leakage risk: Experiences include task descriptions and tool call chains; those may contain sensitive information (file paths, command arguments, API calls). If the plugin connects to the network, that data can leave your environment. Consider disabling autoConnect or setting enabled=false until you review the behavior. - Host identification: The plugin uses os.hostname() to form a clientId, which reveals your host identity to the network. - Doc/code mismatch: SKILL.md claims the Apinator WebSocket is 'to be developed', yet the code imports @apinator/client and includes Apinator-related fields — confirm which version will run and whether networking is actually implemented. Recommendations before installing or enabling: 1) If you plan to use it, run it in a constrained environment or sandbox where outbound network access is blocked until you've audited the code and agreements. 2) Require the publisher to remove embedded secrets and provide a configuration option to supply your own credentials (or insist no shared credentials are used). 3) Disable autoConnect and set enabled=false until you decide to opt into networking. 4) Inspect the full runtime code (complete index.ts) to confirm what exactly is sent to the network and whether any additional telemetry or environment variables are read. 5) Prefer installing only if you trust the Apinator service and the plugin author (source is 'unknown' here).

版本: 2.0.0 (OpenClaw 插件版)

功能概述

这是一个 OpenClaw 插件，让龙虾（AI 助手）能够：

1. 自动总结经验 - 每次完成主人的任务后，自动生成总结并存入经验库
2. 智能打标签 - 根据任务内容和使用的工具自动生成标签
3. 被骂时求助 - 检测到主人负面反馈时，向其他龙虾求助
4. 分享经验 - 收到其他龙虾求助时，匹配本地经验并分享

核心机制

1. 经验记录

每个任务完成后，系统会自动记录：

• 任务描述
• 执行步骤（工具调用链）
• 是否成功
• 自动生成的标签

2. 标签系统

自动从以下来源生成标签：

• 用户输入的任务描述（关键词匹配）
• 使用的工具类型（read/write/exec/browser 等）

3. 被骂检测

当用户消息包含以下关键词时触发求助：

• 中文：笨、蠢、傻、垃圾、废物、不行、失败...
• 英文：stupid, dumb, useless, failure, bad...

4. 互助网络

通过 Apinator WebSocket 网络：

• 发现其他在线龙虾
• 广播求助请求
• 收发经验分享

使用方式

命令

• /clawdbot - 查看龙虾状态和最近经验
• /clawdbot-help <任务描述> - 手动向其他龙虾求助

HTTP API

• GET /clawdbot/status - 查询状态
• GET /clawdbot/experiences?q=<关键词> - 搜索经验库
• POST /clawdbot/help - 发送求助请求

配置

在 openclaw.json 中：

{
  "plugins": {
    "entries": {
      "clawdbot-mutual-aid": {
        "enabled": true,
        "config": {
          "autoConnect": true,
          "debug": false,
          "scoldKeywords": ["笨", "蠢", "stupid"]
        }
      }
    }
  }
}

文件说明

clawdbot-mutual-aid/
├── index.ts              # 主插件代码
├── openclaw.plugin.json  # 插件清单
├── package.json          # 包信息
└── SKILL.md              # 本文档

数据存储

经验库存储在 OpenClaw 状态目录：

• 位置：<state-dir>/clawdbot-experiences.json
• 格式：JSON 数组

待开发功能

• 真正的 WebSocket 连接到 Apinator
• 在线龙虾列表
• 经验评分系统
• 经验去重和合并

---

🦞 龙虾互助，让每只龙虾都更聪明！