Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

work-estimation-en

v1.0.1

Software Development Work Estimation Skill. Triggered when user mentions "work estimation", "project estimation", "effort estimation", "timeline assessment",...

0· 42·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jinqiu193/work-estimation.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "work-estimation-en" (jinqiu193/work-estimation) from ClawHub.
Skill page: https://clawhub.ai/jinqiu193/work-estimation
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install work-estimation

ClawHub CLI

Package manager switcher

npx clawhub@latest install work-estimation
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
SKILL.md describes automatic requirement analysis and accepts document paths (.md, .docx, .txt). The included Python code (generate_estimation.py) only implements Excel generation from a structured modules list and does not perform NLP breakdown or any .docx parsing; no dependency (e.g., python-docx or NLP libraries) is declared. This is plausible if the LLM does the breakdown and the script only formats results, but the repository contents imply a mismatch between the claimed end-to-end automation and the code provided.
Instruction Scope
SKILL.md instructs collecting requirement text or document paths and producing Excel reports — that scope is appropriate. The code itself performs only offline Excel creation and date calculations (including holiday skipping). However scripts/test_login.py contains a hardcoded Windows developer path (C:/Users/Administrator/...) inserted into sys.path which references a user-specific runtime location; this is unexpected and should be reviewed. There are no instructions or code that read environment secrets or make network calls.
!
Install Mechanism
There is no install spec. The Python code depends on third-party packages (openpyxl is imported) but the skill does not declare or install these dependencies. This can cause runtime failures or lead to ad-hoc installs on the host (operator may pip-install packages). Missing dependency declarations are a packaging/operational concern.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The code does not attempt to read secrets or external config. The only oddity is the hardcoded sys.path insertion pointing to a user-specific Roaming path — not a credential, but it references an agent/runtime directory which is unexpected and should be checked.
Persistence & Privilege
Skill flags are default (always:false, user-invocable, normal autonomous invocation allowed). There is no install step and no code that modifies other skills or system agent configuration. No persistent privileged behavior detected.
What to consider before installing
This skill appears to be a legitimate Excel report generator for estimations, but there are mismatches and small risks you should address before installing: - Missing dependency declaration: generate_estimation.py imports openpyxl but the skill has no install spec. Ensure the runtime has the correct Python packages installed (or ask the author to provide a proper requirements list/install). Running in a sandbox or virtual environment is recommended. - Functionality mismatch: SKILL.md promises automatic requirement parsing and support for .docx, but the bundled code only formats already-structured modules into Excel. Verify whether the LLM agent is expected to do the NLP breakdown, or whether the skill should include parsing code. Ask the publisher to clarify. - Hardcoded developer path: scripts/test_login.py inserts a Windows user Roaming path (C:/Users/Administrator/...) into sys.path. This is unusual in distributed packages — inspect or remove this test file before running, and confirm it won't access unexpected local files. - No network calls or credential requests were found in the code, which is good; still, review any future changes for hidden endpoints. If you proceed: run the code in an isolated environment, inspect/clean the test script, and request a dependency manifest (requirements.txt) or an install spec from the author. If the author intends the LLM to perform the breakdown, confirm that in documentation to avoid surprise expectations.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a2mc0rz27p1nhpx5rm4xp7185mknm
42downloads
0stars
1versions
Updated 1d ago
v1.0.1
MIT-0

📊 Software Development Work Estimation

Automatically analyze user requirements, break them into specific work items, and estimate effort across multiple dimensions, outputting structured Excel reports.

Workflow

Step 1: Collect Requirements

User provides:

  • Requirements description (plain text)
  • Or requirements document path (supports .md, .docx, .txt formats)

Step 2: AI Requirements Breakdown

AI automatically:

  1. Analyzes requirement content
  2. Breaks down into specific work modules
  3. Categorizes by dimension (Analysis, Design, Frontend, Backend, Algorithm, Testing)

Step 3: Effort Estimation

For each work item, evaluate:

  • Workload (man-days)
  • Complexity (Low/Medium/High)
  • Risk Level (Low/Medium/High)
  • Parallel Feasibility
  • Prerequisites

Step 4: Generate Excel

Multi-sheet Excel report:

  • Overview
  • Dimension Details
  • Gantt Chart (Project Progress)
  • Key Risk Items
  • Coordination Relations
  • Cost Estimation

Output Description

Sheet 1: Overview

Work ModuleAnalysisDesignFrontendBackendAlgorithmTestingTotal
Module A1 day2 days3 days5 days1 day2 days14 days

Sheet 2-7: Dimension Details

Work content, estimation basis, and estimated hours by dimension.

Sheet 8: Gantt Chart

Visual display of parallel work, critical path, and milestones. Automatically skips weekends and holidays.

Sheet 9: Key Risk Assessment

Items with high risk or uncertainty are listed separately with explanations and recommendations.

Sheet 10: Coordination Relations

Dependencies between work items, prerequisites, and coordination matters.

Sheet 11: Cost Estimation

Three parts:

  • Labor Cost: Role × man-days × daily rate
  • Hardware/Software Cost: Servers, domains, SSL, third-party services
  • Total Budget: Includes 15% contingency buffer

Estimation Reference

ComplexityFrontendBackendAlgorithmTesting
Low1-2 days1-3 days1-3 days0.5-1 day
Medium3-5 days3-7 days3-7 days1-3 days
High5-10 days7-14 days7-14 days3-5 days

Notes

  • Estimation based on standard team config (1 frontend, 1 backend, 1 tester)
  • Parallel work reduces calendar time, not man-hours
  • Reserve 10-20% buffer for changes
  • Adjust based on actual team situation

Example

User: Help me estimate this project: Develop an e-commerce mini-app with user login, product display, shopping cart, and order payment

AI:

Got it! I'll help you with the work estimation.

Based on your requirements, I've broken them down into:

📦 **Work Modules**
1. User System (login, register, profile)
2. Product Module (list, detail, search)
3. Shopping Cart Module
4. Order Module
5. Payment Module
6. Infrastructure (routing, state management, API)

Generating detailed estimation report...

Comments

Loading comments...