Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
导购结构分析
v1.0.0导购结构分析工具。分析门店导购的表现结构，识别导购波动对门店业绩波动的贡献度。 核心能力： 1. 导购表现结构分析（人效分布、帕累托分析） 2. TOP/腰部/尾部导购识别 3. 业绩集中度评估 4. 导购波动归因（各导购对门店业绩变化的贡献度） 5. 增长型vs下滑型导购分类 6. 基于累计贡献度的关键人识别...
⭐ 0· 65·0 current·0 all-time
byXtechmerge.AI@gwyang7
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims to analyze clerk performance and requires no external credentials or binaries, but analyze.py inserts a hard-coded path '/Users/yangguangwei/.openclaw/workspace-front-door' and imports get_copilot_data from api_client. That local dependency is not declared in SKILL.md or manifest and suggests the skill expects access to a private project or internal API rather than being self-contained.
Instruction Scope
SKILL.md presents a clean API (analyze(...)) and no mention of reading local modules or contacting internal services, yet the runtime code calls fetch_clerk_data which delegates to get_copilot_data(endpoint). The instructions do not document what get_copilot_data does, what endpoints/hosts it calls, or what credentials/config it requires — granting the skill broad, undocumented discretion to access local modules and remote data.
Install Mechanism
There is no install spec (instruction-only) which is low risk in general. However, the shipped analyze.py expects a non-packaged local dependency via modification of sys.path. That is an unusual packaging choice: instead of bundling or documenting the dependency, the code reaches into a specific user's home directory. This could fail or cause unexpected imports if that path exists on the host.
Credentials
The manifest declares no required environment variables or credentials, but the code relies on api_client.get_copilot_data — a function likely to access remote APIs and possibly use credentials or local config files. Because those credentials/configs are not declared, the skill may end up accessing secrets or internal endpoints without the user being warned.
Persistence & Privilege
The skill does not request always:true, does not modify other skills' configs, and has no install script. It only adjusts sys.path at runtime to import a module; it does not persistently install or enable itself.
What to consider before installing
This skill's purpose (analyzing store clerk performance) is reasonable, but the implementation has a hidden dependency: analyze.py inserts a hard-coded absolute path and imports get_copilot_data from an external/local module (api_client) that is not bundled or documented. That module may call internal APIs or read credentials/config files on your system. Before installing or running this skill: 1) Ask the author to provide or document api_client and get_copilot_data (show the code and where it contacts). 2) Require the skill to be self-contained or to declare any environment variables, hosts, or credentials it needs. 3) If you must run it, inspect the api_client code for network calls and credential access, and run the skill in an isolated environment (sandbox/container) with no sensitive credentials mounted. 4) Prefer a version that packages its dependencies (or uses standard pip/requirements) rather than referencing a user-specific path. If the author cannot explain or remove the hard-coded path and disclose the external endpoints/credential usage, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk9729ggxf4nr9mqtpbeagevsbx83ncmf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.