AI Company CRO
v1.1.2AI公司首席风险官技能包（CRO）。集团级风险治理、合规审计、危机响应、熔断机制。
⭐ 0· 77·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (AI Company CRO) match the provided documents (SOUL.md, IDENTITY.md, AGENTS.md, TOOLS.md). The files describe risk governance, audit, crisis response and circuit-breakers — all coherent with a CRO skill. There are no unrelated required binaries, env vars, or config paths.
Instruction Scope
Runtime guidance (read SOUL.md, USER.md, recent memory files; log risk events; coordinate cross-agent messages) is within the expected scope of a CRO. The instructions do not direct the agent to exfiltrate secrets, call external endpoints, or read system files outside the skill workspace.
Install Mechanism
No install spec and no code files — instruction-only skill. This minimizes disk writes and third-party package risk.
Credentials
The skill requests no environment variables or credentials (proportionate). One minor note: SOUL.md / IDENTITY.md assert a high permission level ("权限级别：L4 (可调用所有C-Suite Agent)") and cross-agent call conventions (sessions_send). Those are platform-level privileges rather than environment variables; the skill does not request credentials itself. Verify platform enforces and audits cross-agent permissions before granting broad invocation rights.
Persistence & Privilege
always=false (not force-included). disable-model-invocation is default (false), which is normal. The skill does not attempt to modify other skills or system-wide settings in its docs.
Assessment
This skill appears internally consistent and relatively low-risk: it's instruction-only, declares no installs or secrets, and its actions (read local agent docs/memory, coordinate with other C-suite agents, log events) match a CRO's responsibilities. Before installing, verify two things: (1) provenance — there is no homepage and owner identity is opaque, so confirm you trust the source; (2) platform permissions — the skill's docs assume high cross-agent privileges (L4); make sure your platform enforces least privilege and audit logging for any cross-agent calls. Also note small inconsistencies in version fields across files (meta.json / SKILL.md / registry) — a sign of sloppy packaging but not necessarily malicious. If you need stronger assurance, request the author/source, or run the skill in a restricted/test environment with auditing enabled first.Like a lobster shell, security has layers — review code before you run it.
ai-companyvk973gzr4gp3djf0620ngkcwy8x84mfxec-suitevk973gzr4gp3djf0620ngkcwy8x84mfxecrovk973gzr4gp3djf0620ngkcwy8x84mfxegovernancevk973egh17x898cvj9yd211ew7x84n3cblatestvk97c1fj5vtw948dp7e0nb90dp184qdw6risk-managementvk973egh17x898cvj9yd211ew7x84n3cb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚠️ Clawdis
OSLinux · macOS · Windows