Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
统计分析与论文框架 (Agentic AI 科研平台)
v0.1.0对候选队列执行描述性统计与组间比较，生成感染率对比、描述统计表、结果摘要与论文框架草案。当用户需要做统计分析或生成论文框架时触发。
⭐ 0· 67·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name and description match a stats-and-paper-drafting task, but the SKILL.md requires reading a specific file (/home/ubuntu/workspace/demo/mock_data/analysis.json) and posting status to http://localhost:5001/api/report. The registry metadata declared no required config paths or endpoints—this mismatch is unexplained and disproportionate to the claimed functionality.
Instruction Scope
The runtime instructions explicitly tell the agent to read a local filesystem path and to send POST requests to a localhost HTTP service. These actions are outside the declared requirements and could access sensitive data or interact with local services without the user being aware. The instructions do not specify fallback behavior, authorization, or user confirmation.
Install Mechanism
No install spec and no code files (instruction-only) — lowest install risk because nothing is written to disk by an installer.
Credentials
The skill declares no environment variables or credentials (reasonable for a local demo). However, it performs network calls to a local endpoint and reads a hard-coded path despite not declaring these as required config; this should have been made explicit so users can judge access scope.
Persistence & Privilege
always:false and no indication the skill modifies agent/system configuration or demands permanent presence. Autonomous invocation is allowed (platform default) but not combined with other high-privilege settings.
What to consider before installing
Before installing or running this skill, confirm these points: (1) The SKILL.md reads a specific file path (/home/ubuntu/.../analysis.json). Make sure that path is correct for your environment and does not point to sensitive data; ask the author to make the data path configurable rather than hard-coded. (2) The skill posts start/completion messages to http://localhost:5001/api/report — verify that this local service is expected and trustworthy, or request an option to disable reporting. (3) Because the skill is instruction-only and has no provenance or homepage, ask the publisher for source/ownership information and a sample of the expected input JSON format. (4) For safety, run the skill in an isolated/test environment with non-sensitive sample data first. (5) If you need to use your own datasets, insist on a configurable data path and explicit permission prompts so the agent won't read arbitrary files.Like a lobster shell, security has layers — review code before you run it.
latestvk97535wxyz4rqypfw4nsdggsxd83px7z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.