技能检索

This skill mostly implements a legitimate ranking/discovery tool, but there are red flags you should address before trusting it: - Investigate the Tencent API URL (https://lightmake.site/api/skills). Confirm the maintainer and prefer an official endpoint (skillhub.tencent.com or your own trusted registry). Do not rely on an unfamiliar third‑party host unless you trust it. - The tool will read GITHUB_TOKEN from your environment and can write that token into ~/.openclaw/skill-rank/config.json. Only provide a GitHub token with the minimal scopes needed, or run without a token; consider running the first update in an isolated environment (container/VM) to observe behavior. - Review the code (scripts/*.py) yourself or run it in a sandbox to see which endpoints it contacts during --update. Look for unexpected outbound hosts beyond the declared sources (xfyun, Tencent, GitHub, raw.githubusercontent). - If you plan to install/run this skill for real users, replace the default tencent_api_url with an authoritative source and remove or explicitly document any third‑party proxies. - If you need higher assurance, ask the publisher for a homepage, maintainership information, and an explanation for the lightmake.site endpoint; absence of provenance lowers trust. If you want, I can point to the exact lines that set the suspicious endpoint and where the GITHUB_TOKEN is read, or produce a diff that hardcodes trusted endpoints before you run it.