Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Code Archaeology
v2.5.0Analyze legacy codebases to extract business rules, technical specifications, and migration requirements. Use when analyzing PHP, Java, Python, or other lega...
⭐ 1· 87·1 current·1 all-time
byroboe@hickhe
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name, README, SKILL.md and included scripts (integrator, converter, process-file-manager) are coherent with a legacy-code analysis -> generate migration/context-documents workflow. However the integrator expects specific file names prefixed with 'zbs_php_' and the default business domain is hardcoded to 'finance', which narrows applicability without justification. _meta.json version (2.4.0) differs from registry version (2.5.0) — a minor metadata inconsistency.
Instruction Scope
Runtime instructions ask the agent to read full source trees and produce many local artifacts (expected for this tool). The scripts create and write files on disk and the ProcessFileManager has a hardcoded default baseDir of '/Users/admin/.openclaw/workspace' (creates folders and files there) which is surprising and platform-specific. The SKILL.md also references external CLI tools (ai-plan-generator, clawteam) that are not included; the convert script calls integrator.generateValidationStandards(), but that method is not defined in the integrator — this is a runtime bug that could cause errors during execution. No instructions request secrets, but outputs may contain sensitive business code and credentials if present in the analyzed source (so exercising principle of least privilege is important).
Install Mechanism
There is no install spec (instruction-only skill), so nothing will be automatically downloaded or installed by the platform. The included Node.js scripts are present but will only run if the user or agent executes them. This is lower-risk than remote downloads, but local execution still writes files.
Credentials
The skill declares no required environment variables or credentials (good). However it assumes a Node.js runtime (README notes Node.js v14+) and local filesystem access to the legacy codebase — which is expected for its purpose. The integrator generates integration configs (database, redis, enterprise_wechat) that may imply further credentials are needed downstream, but none are declared here.
Persistence & Privilege
The skill does not set always:true and does not request platform-wide privileges. Nevertheless, its ProcessFileManager defaults to writing into a hardcoded user path (/Users/admin/.openclaw/workspace) and will create project directories and files there if executed — this persistent file activity is surprising and could pollute or overwrite user workspace if run without checking the path. The skill does not modify other skills' configuration.
Scan Findings in Context
[hardcoded_user_path] unexpected: ProcessFileManager constructor defaults baseDir to '/Users/admin/.openclaw/workspace'. Writing to a hardcoded user home path is unexpected and platform-specific; user should verify or override before running.
[fs_write_files] expected: The converter and file manager write JSON/MD/YAML files to disk (business-rules.json, technical-specs.yaml, etc.). This is expected for a conversion/analysis tool but means outputs may include sensitive code or secrets present in the analyzed source.
[missing_method_call] unexpected: convert-to-ai-plan-generator.cjs calls integrator.generateValidationStandards(), but that method is not defined in code-archaeology-integrator.cjs — likely a bug that will cause a runtime failure.
What to consider before installing
This skill appears to do what it says (analyze legacy code + produce migration/context docs), but it contains sloppy defaults and bugs. Before running: (1) Inspect the included scripts locally and fix the missing method or other errors; (2) do not run them directly against a production codebase — run in an isolated environment or on a copy; (3) override the default baseDir (/Users/admin/...) to a safe workspace to avoid accidental file writes; (4) be aware that outputs may include sensitive data from your source — treat outputs like secrets and store them appropriately; (5) ensure required external tools (ai-plan-generator, clawteam) and Node.js are deliberate and trusted. If you lack the ability to inspect or sandbox the code, treat this package with caution.Like a lobster shell, security has layers — review code before you run it.
latestvk97840gmdgw4yjs4dnphtdvetd83npst
License
MIT-0
Free to use, modify, and redistribute. No attribution required.