凯米心跳插件
v1.0.0Injects a visual "heartbeat" animation and real-time status indicator into the OpenClaw Web UI to show Kemi's active state.
⭐ 0· 68·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the contents: the SKILL.md contains a short DOM/CSS/JS snippet that adds a visual heartbeat/status indicator to the Web UI. No unrelated permissions, env vars, or binaries are requested.
Instruction Scope
The SKILL.md is narrowly scoped to injecting styles and a status element into the page and only modifies the DOM. It does not read files, access environment variables, or send data externally. Note: the installation instructions suggest running `npx clawhub install ...` (a user-invoked command) which would pull code from npm if used — the skill itself contains no installable package in the provided files.
Install Mechanism
There is no formal install spec in the package (instruction-only). That keeps risk low, but the README suggests an `npx` command; if a user runs that command, it could pull remote code. The provided files themselves do not include downloads or extract operations.
Credentials
No environment variables, credentials, or config paths are requested; this is proportional for a purely client-side UI tweak.
Persistence & Privilege
The skill does not declare 'always: true' and does not modify other skills or system-wide settings. Its persistence is limited to being placed in the skills/ directory as per the instructions.
Assessment
This appears to be a simple, local UI-only plugin. Before installing: (1) review the small JS snippet to ensure you accept the DOM changes; (2) do not run suggested `npx` commands from unknown sources unless you trust the publisher — `npx` can fetch remote packages; (3) install/test in a non-production/staging environment first to ensure it doesn't conflict with your UI or other plugins; and (4) if you need stronger assurance, ask the publisher for a repository or signed release so you can verify origin.Like a lobster shell, security has layers — review code before you run it.
latestvk9784nnewcph8g4x4hjqfzs7gx84bcfj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.