Crayfish Sticker
v0.1.3根据对话情绪和内容智能匹配并发送多分类表情包，支持河南大叔专属表情和动态远程更新。
⭐ 0· 127·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim (auto-matching and sending stickers, dynamic updates) lines up with the SKILL.md. No unexpected credentials, binaries, or system access are requested. The repoUrl in the config points to a raw GitHub URL, which is consistent with 'dynamic remote updates'.
Instruction Scope
Instructions direct the agent to fetch an index.json and images from a remote GitHub repo and cache them locally. This is within the skill's stated scope, but it does mean the skill will make network requests to external content and its behavior can change when the remote repo is updated.
Install Mechanism
No install spec and no code files — instruction-only skill — so nothing will be written to disk by an installer. This is the lowest-risk install model.
Credentials
The skill declares no required environment variables or credentials. That is proportional for a sticker-fetching feature. The only configuration shown is a repoUrl and caching/sending parameters.
Persistence & Privilege
always is false and the skill does not request elevated or persistent system-wide privileges. Autonomous invocation is allowed by default but is not combined with other red flags here.
Scan Findings in Context
[no_code_files_to_scan] expected: The regex scanner had no code files to analyze; this is an instruction-only skill (SKILL.md) that references remote content.
Assessment
This skill fetches an index.json and sticker images from a remote GitHub repository (the repoUrl is hardcoded in the config). Before installing: (1) verify the GitHub repository and its owner (StudyWorkLife) and inspect index.json to ensure it doesn't point to unexpected external domains; (2) be aware that the skill's behavior and content can change whenever the remote repo is updated (dynamic updates); (3) consider whether you want the agent to send stickers automatically — if not, disable autonomous invocation or lower sendFrequency; (4) no secrets are required, but remote images or links could cause network requests that reveal requester metadata (IP) to third parties. If you want stronger assurance, ask the publisher for the repository URL of the actual image files and inspect their contents before enabling the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk972b58w0p51ctpzsgpaqgy3f1833kq5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.