Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Six Dim Evaluator
v0.1.0L4 评估层 - 六维评估引擎。自动化执行六维评估（T/C/O/E/M/U），生成评估报告，提供改进建议。
⭐ 0· 49·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
SKILL.md claims the tool will query the ClawHub API, analyze usage logs, run Jest tests, save evaluation data to a database, and send alerts; however the code in src/index.js only reads local files (README.md, SKILL.md, tests, CHANGELOG.md) and computes heuristic scores using hard-coded placeholders. There are no network calls, no DB code, and no declared environment variables for external services. This mismatch means either the documentation over-promises functionality or required runtime secrets/capabilities are missing/undeclared.
Instruction Scope
The runtime instructions (SKILL.md) direct the agent to run tests, query ClawHub API, analyze logs, generate visualizations, and persist data — actions that can require shell execution, network access, and credentials. The implementation, however, only inspects files under a given skill path and uses placeholder values (e.g., fixed testCoverage). The instructions are broader and vaguer than the code, and mention tools (Bash/Exec) and external endpoints without specifying required permissions or env vars.
Install Mechanism
There is no install specification (instruction-only skill), so nothing will be downloaded automatically by the platform. The package includes package.json and a package-lock.json with normal dependencies (commander, jest devDeps and large dev dependency tree). Because there is no automated installer specified, installing or running the node package would be a manual step — lower platform risk — but review of package-lock is advisable before running npm install from an untrusted source.
Credentials
SKILL.md describes interactions that normally require credentials (ClawHub API access, a database for persisted evaluations, alerting/notification targets), yet requires.env and primary credential are empty. The implementation does not use or request any env vars, which is inconsistent with the documented external integrations. This gap could mean missing declarations, or that later changes/versions might request secrets unexpectedly.
Persistence & Privilege
The skill does not request permanent presence (always: false), does not declare config paths or system-wide modifications, and the code does not modify other skills or global agent settings. Autonomous invocation is allowed by default (platform normal) but not combined with other high-risk attributes here.
What to consider before installing
This package is internally inconsistent: the documentation promises external integrations (ClawHub API, DB storage, log analysis, alerts) but the code only performs local file inspection with placeholder values. Before installing or running it: 1) Ask the author for the source repository and verify provenance (public git, commit history). 2) Confirm what external APIs/databases it will call and require explicit env var names and scopes (ClawHub API key, DB credentials). 3) Inspect package-lock.json for unexpected/obfuscated dependencies and run npm install only in a sandbox. 4) Run the code locally in a safe environment to verify behavior (no network connections, no writes to unexpected locations). 5) If you plan to allow the agent to execute shell or network actions on your behalf, only grant minimal, documented credentials and prefer short-lived credentials or scoped tokens. Because of the mismatch between docs and code, treat this skill as untrusted until the author clarifies intended external integrations and provides verifiable source.Like a lobster shell, security has layers — review code before you run it.
latestvk979g0rvbmpr0q36j2mzdwyea184aftv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.