Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Code Quality Analyzer (FightingDao)
v1.0.0代码质量分析技能，用于分析代码仓库的周/月维度变更，生成交付报告并同步到代码质量分析系统数据库。触发场景：(1) 用户要求进行代码质量分析 (2) 生成周报/月报 (3) 统计代码变更 (4) 分析分支提交 (5) 同步分析数据到数据库。
⭐ 0· 34·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The declared purpose is a repository code-quality analyzer which is reasonable, but the metadata claims no required env vars, binaries, or config paths while the SKILL.md hard-codes local project paths (/Users/zhangdi/...), script paths, a local DB API (http://localhost:3000/api/v1), Teams webhook secret, and an email config file. Those resources are necessary for the described functionality and should have been declared. The absence of declared requirements is inconsistent.
Instruction Scope
SKILL.md instructs the agent to run git commands (git fetch, git log, git shortlog), read and run local scripts, collect fileChanges and commit details, and sync structured records into database tables (code_analyses, code_issues, code_reviews, team_statistics, project_statistics). It also references reading an email config file and using a Teams webhook secret. The instructions therefore require reading local filesystem paths and hitting local network endpoints that were not documented in the skill metadata.
Install Mechanism
The skill is instruction-only with no install spec and no code files — lowest install risk. There is nothing being downloaded or written by the skill package itself.
Credentials
Despite declaring no required environment variables or credentials, the instructions implicitly rely on sensitive configuration: a local API endpoint (http://localhost:3000), an email config file (~/.openclaw/workspace/.email-config.json), and a Teams webhook with signing secret. These are effectively credentials/configs but are not declared. That mismatch prevents reviewers from knowing what secrets the skill needs or could access.
Persistence & Privilege
always is false and autonomous invocation is allowed (platform default). The skill's instructions will modify external state (sync records to a DB, send notifications). This is consistent with its purpose but increases risk if the local endpoints or scripts are malicious or misconfigured. No indication the skill tries to persist itself or alter other skills' configs.
What to consider before installing
Before installing or enabling this skill:
- Treat it as high-privilege: it expects to read local repositories, run local scripts, and push data to a local API and notification endpoints.
- Ask the publisher to declare required env vars/configs (DB URL, DB credentials, Teams webhook secret, email config) and justify why each is needed.
- Do not run it on sensitive machines. Test in an isolated environment/container with a disposable repo and a mock DB/API to observe behavior.
- Inspect the actual scripts referenced (/Users/zhangdi/…/analyze-code-v2.js, sync-to-db.js, notify scripts) before allowing execution; if you cannot inspect them, decline or run only under tight controls.
- If you must use it, restrict network access or use a local mock of http://localhost:3000 to ensure no unintended external data flows or destructive DB writes occur.Like a lobster shell, security has layers — review code before you run it.
latestvk970hpradycjctrbpw2we91q498402a0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.