Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Framework Analysis

v1.0.0

基于钱学森"框架法"的系统科学分析工具。用于对地缘政治冲突、国际危机、历史事件等复杂系统进行结构化终局推导。 核心方法论来自钱学森《用系统科学方法使历史科学定量化》: 1. 建立结构性约束框架(不是列出因素,而是找到不会变的硬条件) 2. 填入经过验证的事实 3. 通过因果链推导唯一结论(不做情景列举,不做概率分...

0· 70·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to perform structured 'framework' analysis and web research, which fits the description. However, it also prescribes generating PDFs via a specific local script (~/.openclaw/skills/deep-research-zh/scripts/md2pdf.sh) and sending results via a 'message' tool to Feishu — capabilities that are not justified in the metadata (no required binaries, no required env vars) and appear to depend on other skills/tools not declared.
!
Instruction Scope
SKILL.md directs the agent to 'spawn' parallel sub-agents (sessions_spawn), perform web-searches, write structured files under research/[topic]-analysis-[date].md, run a local md2pdf.sh script, and call message({action:'send', filePath: ...}) to push PDFs. These runtime actions touch local filesystem paths, invoke platform session APIs, and perform external messaging — all beyond a simple analysis instruction and not scoped/qualified in the skill manifest.
Install Mechanism
The skill has no install spec and no code files, which is low-risk from install-time perspective. However, absence of install does not mitigate the runtime dependency references in SKILL.md (local scripts, weasyprint/wkhtmltopdf, CJK fonts).
!
Credentials
The skill requests no environment variables, but instructs using tools/services that typically require credentials or configuration (Feishu messaging, potentially local script permissions, and PDF engines weasyprint/wkhtmltopdf). Those credentials/configs are not declared or documented, which is an incoherence and raises risk of unexpected credential usage/exfiltration if the platform binds message-sending capability to agent credentials.
Persistence & Privilege
always:false and no explicit persistent privileges are requested. Still, the skill writes files under ~/.openclaw and research/, calls a specific script in another skill's path, and spawns sub-agents — these modify user filesystem and initiate network actions at runtime. This is not an immediate privilege escalation but is a behavioral footprint the user should expect and review.
What to consider before installing
Before installing or enabling: 1) Confirm your OpenClaw environment supports the platform APIs the skill expects (sessions_spawn and a 'message' tool) and understand which credentials the message tool uses for Feishu; 2) Verify existence and trustworthiness of the referenced local script (~/.openclaw/skills/deep-research-zh/scripts/md2pdf.sh) and any external PDF binaries (weasyprint/wkhtmltopdf) and CJK fonts — the skill will call them but does not declare them; 3) Decide whether you are comfortable the skill will write files under ~/.openclaw and research/ and send generated PDFs externally (potential data exposure); 4) If you proceed, run the skill in a restricted/sandbox environment first and ask the author to document required binaries, credentials, and exact messaging endpoints; 5) If you want to use the analysis capability but not automatic delivery, request a configuration option to disable automatic PDF creation/sending or to require explicit user confirmation before sending.

Like a lobster shell, security has layers — review code before you run it.

latestvk972gsz6j9rb11evzh62vmdec984cprs
70downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

系统科学"框架法"分析

核心原则

不做A/B/C情景列举,推导唯一结论。

当框架完备、信息充分时,答案只有一个——不是概率分布。如果发现多个等价路径,说明框架不够完备,需要补充约束。

流程

Phase 0: 判断信息需求(自动)

根据主题决定信息收集策略:

情况 A — 当前热点事件(正在发生的冲突/危机): → 进入 Phase 0a,自动 spawn sub-agent 并行调研

情况 B — 历史事件/已有充分公开信息的事件: → 跳到 Phase 1,直接建框架(用 web-search 按需补充)

判断依据:事件是否仍在发展中?最新信息是否关键?如果"是",走 A。

Phase 0a: 自动调研(spawn sub-agent)

sessions_spawn 启动 2-3 个并行调研子任务,每个聚焦一个维度:

spawn 任务示例:
1. "调研 [主题] 的军事态势和各方力量对比,来源:路透社、BBC、观察者网"
2. "调研 [主题] 的经济影响和外交动向,来源:智库报告、官方声明、财经媒体"
3. "调研 [主题] 的历史背景和关键人物,来源:学术资料、维基百科、深度报道"

每个 spawn 任务应包含:

  • 明确的搜索关键词和优先来源
  • 输出格式:结构化事实清单 + 来源标注
  • 限制:每个任务控制在 5-8 条核心事实以内,避免信息过载

等所有 sub-agent 返回后,整合结果进入 Phase 1。

Phase 1: 建立框架 — 找结构性约束

约束 = 不随时间、情绪、短期事件变化的硬条件。

找约束的提问清单:

  • 各方的核心目标是什么?目标之间是否对称?
  • 军事/经济/外交手段的天花板在哪?
  • 有没有不可逆的成本在累积?(时间对谁更不利?)
  • 关键决策者面临什么时间窗口或政治约束?
  • 历史/文化/制度层面的底线是什么?

格式要求: 每个约束写成一句话"铁律",附 3-5 行论据。

Phase 2: 填入事实 — 信息验证

事实在框架中的位置来源可信度
...对应哪个约束高/中/低

要求:

  • 每个事实必须标注来源(Phase 0a 的 sub-agent 结果或 web-search 结果)
  • 事实与框架矛盾时,要么调整框架,要么验证事实
  • 注意区分"事实"和"一方声称"——后者标注为声明而非事实

Phase 3: 因果推导 — 从约束到结论

从约束出发,建立因果链:

  • 每一环必须由上一步 + 事实共同决定
  • 标注哪一环是"分歧点"(如果改变某个前提,结论会变)
  • 最终推导出唯一结论

推导格式:

第一环:[约束X] + [事实Y] → [中间结论]
第二环:[中间结论] + [约束Z] → [下一个中间结论]
...
终局:[唯一结论]

Phase 4: 可证伪预测

列出 3-5 条可在一周/一个月内验证的预测。说明:

  • 如果 X 发生,框架被验证
  • 如果 Y 发生,框架需要修正
  • 如果超过半数被证伪,框架推翻

输出结构

# [主题]终局推导
**方法:基于钱学森"框架法"的系统科学分析**
**日期:[YYYY-MM-DD]**

## 一、方法论说明(3句话概括)

## 二、结构性约束(3-7个)
### 约束1:[名称]
- 铁律:[一句话]
- 论据:[2-4行]

## 三、事实矩阵(表格)

## 四、因果推导
[逐环推导]

## 五、唯一结论
[结论 + 具体形态]
[为什么是唯一的 — 需要同时满足哪些硬约束]

## 六、可证伪预测(3-5条)

关键注意事项

  1. 约束必须是结构性的,不是策略性的。"伊朗可能使用核武器"是策略推测,"伊朗无法在承受全面战争的同时维持政权稳定"是结构性约束
  2. 避免信息过载。10条高质量约束 > 50条信息碎片。框架法的美在于用最少的硬条件压缩最大的解空间
  3. 区分"想要"和"能做到"。经常被忽略的约束:一方想要X但能力不够,或者有能力但代价不可接受
  4. 时间压力的不对称是最常被低估的约束。问:谁更着急?为什么?着急的那方在压力下会做什么让步?
  5. 内部矛盾 vs 外部矛盾:外部冲突升级时,内部矛盾往往被压制。这是分析政权行为时的关键变量

交付(自动)

分析完成后,自动执行以下步骤:

Step 1: 生成 PDF

~/.openclaw/skills/deep-research-zh/scripts/md2pdf.sh research/[topic]-analysis-[date].md research/[topic]-analysis-[date].pdf
  • 引擎优先级:weasyprint > wkhtmltopdf
  • 内置 CJK 字体支持(Noto Sans CJK SC / PingFang SC)
  • A4 纸、2cm 边距、14px 正文、表格/代码块样式优化

Step 2: 发送飞书

使用 message tool 发送 PDF:

message({ action: "send", message: "📊 [主题]框架法终局推导", filePath: "research/[topic]-analysis-[date].pdf" })

Step 3: 简要汇报

飞书中附上:一句话核心结论 + 关键约束数量 + 可证伪预测条数。

注意: 如果 PDF 生成失败,直接发送 Markdown 原文。

Comments

Loading comments...