Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Chinese-language helper for finding and installing ClawHub skills, with no hidden persistence, credential handling, or destructive behavior found.
Install this if you want a Chinese-language ClawHub skill finder. Review recommendations before running any clawhub install command, because installing third-party skills can change what your agent is able to do.
The trigger text is very broad and overlaps with normal user conversation such as asking for help finding a skill. That can cause the skill to activate in many unrelated contexts, increasing the chance of unintended tool use, unexpected installation guidance, or routing control away from more appropriate skills.
The usage section defines activation examples that are also common conversational requests, so the skill may be selected whenever a user casually mentions needing a capability. In a skill that recommends and installs third-party skills, overbroad activation increases the risk of unnecessary enumeration and installation flows being initiated without sufficiently specific user intent.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
→ 推荐安装
安装命令: clawhub install crypto-tracker 安装后验证: ls ~/.openclaw/workspace/skills/crypto-tracker/SKILL.md
## v1.0.1 更新
The package name and description explicitly label the skill as "CN" and include Chinese-language branding, but this manifest does not indicate that locale behavior is optional or limited to a justified region-specific use case. That can violate language/locale policy expectations when users are not given a choice or clear documentation about the locale constraint.
The script includes user-facing text only in Chinese, such as the title and usage message, without offering any language choice. This can violate a language/locale policy when users are not given an explicit opt-in or alternative locale.
No suspicious patterns detected.