本技能用于分析 Java 微服务项目中 Controller 层的完整调用链路，能够自动追溯到 Service、Mapper、Repository 层，并提取完整的 SQL 语句。最终生成结构化的 JSON 文件，便于 API 文档生成、代码审计或架构理解。

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for local Java code analysis, but it will read project source files and write a JSON report that may contain internal API and SQL details.

This appears safe for its stated purpose as a local Java project analysis aid. Before installing or invoking it, make sure you are comfortable with the agent reading the relevant source files and producing a JSON file that may expose internal APIs, business logic, and SQL statements.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The generated report may include internal service structure, API routes, and complete SQL statements from the project.

Why it was flagged

The skill directs the agent to read and search local project files and then write a generated JSON report. This is expected for source-code call-chain analysis, but it is still local file access that users should scope carefully.

Skill content

读取 Controller 文件 ... 查找接口的实现类 Search(pattern: "implements 接口名称", path: "项目地址") ... 生成 JSON 输出

Recommendation

Use it only on repositories you intend to analyze, keep the output directory within the project or another trusted location, and avoid sharing the generated JSON if it contains sensitive implementation or database details.