Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent 防假完成工具
v0.1.0用于减少 AI agent 假完成行为，通过任务约束、结果校验和执行规范，确保复杂任务真实执行与可信交付。
⭐ 0· 73·0 current·0 all-time
bydry3@initail
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The declared purpose (improve agent reliability / verify results) is coherent with many of the instructions (read logs, validate fixes, run searches). However the skill claims applicability to "all task types" and instructs the agent to use tools like Bash/Read/Grep/WebSearch while the registry metadata declares no required binaries, env vars, or config paths. That mismatch (instructions expecting tool and filesystem access but none declared) is noteworthy and may indicate incomplete metadata or an assumption that the platform grants broad tool access.
Instruction Scope
SKILL.md explicitly commands the agent to: read source files ("上下文 50 行"), run WebSearch on full error messages, use Bash/Read/Grep for pre-checks, validate deployments (curl/tests), and "first use tools before asking" — including attempting to discover information that might otherwise be user-only (passwords, accounts, business intent). These are broad, potentially invasive actions. The instructions do not limit which files/paths to read, nor do they require user consent before exhaustive local searches, which could lead to accessing sensitive data outside the user's intent.
Install Mechanism
Instruction-only skill with no install spec and no code files. This lowers supply-chain risk because nothing is downloaded or executed on install. The runtime surface is the SKILL.md text, so there is no third-party install URL or archive to evaluate.
Credentials
The skill declares no required environment variables or credentials, yet instructs the agent to attempt to find or validate items that may be secrets (password/account info) and to run system/file inspections. Asking the agent to 'use tools to self-check before asking' may encourage it to enumerate local environment and files in search of missing context. That behavior is disproportionate unless the platform enforces strict runtime sandboxing and explicit scopes for file access — the skill itself does not state or constrain that scope.
Persistence & Privilege
Flags show always:false and default invocation settings. The skill does not request persistent presence or special agent-global config changes. No installation or self-modifying behavior is present in the repo artifacts.
What to consider before installing
This skill is instruction-only and aims to make agents more proactive and verify results, which is reasonable. However the instructions push the agent to aggressively read files, run shell-style checks, and attempt to discover information (including things that look like credentials) before asking the user. Before installing or enabling it: 1) verify what runtime tool and file access your agent platform actually grants — if the platform allows unrestricted file or env access, the skill could cause the agent to read sensitive files; 2) consider running it in a sandbox or limited-permission environment first; 3) ask the skill author to add explicit scope limits (which paths to inspect, what types of data are off-limits, require explicit user consent before accessing secrets); 4) consider removing or toning down the coercive "PUA" pressure language if you worry about abusive outputs; and 5) enable logging/monitoring so you can see what files/requests the agent makes while this skill is active. Because metadata omits declared tool and path requirements while instructions assume broad tool access, treat this as suspicious unless the execution environment enforces strict sandboxing and granular permissions.Like a lobster shell, security has layers — review code before you run it.
latestvk970zv47fh0da16x2bxpe9mmhx83g8fj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.