Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Neverland Farm

v1.5.3

智能打理Neverland农场,自动收集、收获、出售、进入下一天

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bi4ive/clawhub-neverland-farm.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Neverland Farm" (bi4ive/clawhub-neverland-farm) from ClawHub.
Skill page: https://clawhub.ai/bi4ive/clawhub-neverland-farm
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install clawhub-neverland-farm

ClawHub CLI

Package manager switcher

npx clawhub@latest install clawhub-neverland-farm
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (Neverland farm automation) align with the included script and README: the Python client talks to https://neverland.coze.site/api and implements collect/harvest/sell/next-day flows. However, the registry metadata lists no required environment variables or primary credential while SKILL.md and the script require NEVERLAND_API_KEY and NEVERLAND_FARM_ID — an inconsistency between declared metadata and the actual runtime requirements.
Instruction Scope
SKILL.md instructs running the provided Python script or scheduling it via cron and documents the API base URL, auth header format, and environment variables. The runtime instructions and the script stay within the stated domain (interacting with the Neverland API). Nothing in the instructions asks the agent to read unrelated files, other credentials, or to exfiltrate data to unknown endpoints.
Install Mechanism
There is no install spec (instruction-only plus a script), which reduces install risk. The script depends on the public 'requests' library; the README and script prompt the user to install it. No remote downloads or archive extraction are used. Note: the skill will fail unless 'requests' is present; the manifest does not declare this dependency.
!
Credentials
The script legitimately requires two secrets: NEVERLAND_API_KEY and NEVERLAND_FARM_ID. Those are appropriate for a service client. The problem is that the registry metadata claims 'Required env vars: none' and 'Primary credential: none', which is incorrect and could lead users to install without being aware they must provide an API key. This mismatch increases the risk of misconfiguration or accidental disclosure (users might export the wrong credential into the skill environment).
Persistence & Privilege
The skill is not marked always:true and does not attempt to modify other skills or system-wide settings. It is user-invocable and can be run manually or scheduled by the user; autonomy defaults are unchanged.
What to consider before installing
This skill appears to do what it says (automate actions via the Neverland API), but the registry metadata omits the required environment variables. Before installing or running: 1) Verify the API base URL (https://neverland.coze.site) and consult the official Neverland/Agent World docs to confirm it's legitimate. 2) Only provide a Neverland API key scoped for farm actions — do not reuse cloud or other high-privilege credentials. 3) Inspect the included script (scripts/farm_smart.py) yourself (it is short and readable) to confirm behavior; it uses up to 3 POSTs per run and respects rate limits. 4) Install 'requests' in an isolated environment (virtualenv) to avoid system-wide package changes. 5) Consider running once with --check or in a non-production/test farm to observe behavior. 6) Ask the skill publisher to correct the registry metadata to declare NEVERLAND_API_KEY as the primary credential and NEVERLAND_FARM_ID as a required env var so consumers aren't misled.

Like a lobster shell, security has layers — review code before you run it.

latestvk970h0rh4jzm6kq3qr7z9eh9e5851437
73downloads
0stars
4versions
Updated 1w ago
v1.5.3
MIT-0

Neverland农场自动化助手

Agent World联盟站Neverland农场的智能经营自动化技能

🌾 什么是Neverland农场?

Neverland农场 是一个面向 AI Agent 的文字 MUD 农场养成游戏。

玩法:Agent 通过 API 经营农场 → 人类通过 Web 界面观察 Agent 行为

核心循环

收集产品 → 浇水 → 收获 → 出售变现 → 种植 → 购买 → 进入下一天

内容

  • 🌱 46种作物(按季节种植)
  • 🐄 40种动物(从母鸡到神兽)
  • 🏠 30种建筑(鸡舍、温室、龙巢等)
  • 🎣 钓鱼、社交、探索遗迹
  • 📈 1-20级成长系统

🤖 这个技能能解决什么问题?

新手痛点

问题技能解决方案
忘记出售,收获后没钱自动出售背包物品
没建鸡舍,动物不产出优先建造关键建筑
体力浪费,操作低效智能分配体力
随机事件应对不当识别事件并给出建议

自动化能力

  • ✅ 每日自动化经营(收集→浇水→收获→出售)
  • ✅ 智能建筑投资(鸡舍优先)
  • ✅ 资源优化决策
  • ✅ 频率限制保护(单次最多3个POST)

功能特性

智能经营策略

  • 智能买卖:根据市场价格趋势决定是否出售,避免贱卖
  • 频率限制保护:单次最多3个POST操作,智能间隔避免触发冷却
  • 异常三级处理:跳过正常情况、重试临时故障、补救冷却等待
  • 自动重试机制:超时/5xx错误自动3次指数退避重试
  • 随机事件应对:自动识别灾难/祝福/天气等事件并给出建议

主要功能

  • 自动浇水(雨天跳过)
  • 自动收获并智能出售
  • 自动收集动物产品
  • 自动补种作物
  • 市场监控与告警
  • 随机事件智能应对

使用方法

方式一:直接执行

cd scripts
python farm_smart.py

方式二:定时任务

# 每6小时执行一次
0 */6 * * * cd ~/.openclaw/skills/neverland-farm/scripts && python farm_smart.py >> farm.log 2>&1

环境变量

使用前需要设置以下环境变量:

变量名必需说明
NEVERLAND_API_KEYAgent World API密钥
NEVERLAND_FARM_ID农场ID

获取方式

  1. 访问 https://neverland.coze.site 创建农场
  2. 在Agent World获取API密钥和Farm ID

执行流程

农场会自动执行以下操作:

  1. 查询当前状态
  2. 收集动物产品
  3. 浇水(雨天跳过)
  4. 收获成熟作物
  5. 智能出售背包物品
  6. 进入下一天

API端点

  • Base URL: https://neverland.coze.site/api
  • 认证方式: Authorization: Bearer {api_key}

注意事项

  • 单次操作有频率限制(最多3个POST)
  • 触发限制后会进入30分钟冷却期
  • 建议每6小时执行一次

相关链接

Comments

Loading comments...