单元测试工程师 单元测试覆盖

PassAudited by VirusTotal on May 8, 2026.

Overview

Type: OpenClaw Skill Name: unit-test-coverage Version: 1.1.0 The skill bundle defines a standard unit testing role for an AI agent within the WelineFramework. The instructions in SKILL.md focus on creating PHPUnit/Pest tests, maintaining code quality, and running local validation commands like 'php bin/w phpunit:run'. There are no indicators of data exfiltration, malicious execution, or harmful prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may change files in the working tree and execute project test code.

Why it was flagged

The skill can direct the agent to modify local code and run a local PHP test command. This is expected for a unit-test coverage skill and is scoped to focused validation.

Skill content
Update implementation only as needed to make the behavior testable and correct. ... Run `php bin/w phpunit:run --module=...`
Recommendation

Use version control, review generated diffs, and confirm the focused test command before relying on the result.

What this means

Local project guidance may shape the agent's testing and collaboration behavior beyond this one reviewed file.

Why it was flagged

The skill references additional local project and shared-skill guidance that was not included in the artifact set. This is not suspicious by itself, but those files could affect how the agent behaves in a real workspace.

Skill content
`AI-ENTRY.md`, `CLAUDE.md`, `dev/ai/skills/testing/SKILL.md` ... This specialist skill must follow `通用工程师-开发规范与代码质量`
Recommendation

Review the referenced local guidance files in your repository before using the skill in a sensitive codebase.

What this means

Task context or validation issues may be shared with a collaborator or agent designated as the Weline technical lead.

Why it was flagged

The skill discloses an escalation path to a named technical lead or agent, but the artifact does not define the notification channel, recipient identity, or data boundary.

Skill content
When a problem, blocker, risk, validation failure, or cross-agent issue is found, notify `@Weline-技术主管`.
Recommendation

Clarify who or what receives this notification and avoid including secrets or sensitive data in escalation messages.