Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
winforms-to-qt-mapper
v1.0.0提供完整的C# WinForms到Qt C++迁移指导,包括架构分析、控件映射、事件转换、布局迁移、性能优化和测试验证。适用于从单体WinForms应用重构为分层Qt架构的企业级项目。 使用时机: - 需要将WinForms应用迁移到Qt框架时 - 需要设计Qt分层架构和接口层时 - 需要分析WinForms项目...
⭐ 0· 83·0 current·0 all-time
by@rsgt945
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts and documents (analyzers, mapper, code generator, Roslyn analyzer) are consistent with a WinForms-to-Qt migration tool; Roslyn-based analysis and an 'IntelligentMapper' justify some ML and analysis dependencies. However, package.json and SKILL.md disagree on file locations and names (e.g., SKILL.md references migration_planner.js, code_generator.js, interface_generator.js, layered_architect.js etc., while the manifest contains differently named scripts such as generate_qt_code.js and analyze_winforms.js). The package also lists server/web libraries (express, ws, helmet) and ML libs (tensorflow, brain.js) that are heavier than strictly necessary for a static code-mapping tool and may be disproportionate unless the tool actually provides a web UI or remote ML service.
Instruction Scope
SKILL.md instructs the agent (and user) to run many node scripts against a user's project path, which necessarily reads project files and writes generated Qt code — appropriate for the stated task. But SKILL.md references multiple script filenames that are missing or differently named in the repo, which will cause runtime errors or unexpected behavior. The instruction set is otherwise explicit about scanning source files, generating outputs, and validating UI parity (pixel comparisons, style validation). There is no instruction to send project data to external endpoints in SKILL.md, but some scripts (not fully shown) import child_process and networking-related dependencies, so you should inspect scripts for any network calls before running on private code.
Install Mechanism
No install spec is declared (instruction-only install), so nothing is automatically downloaded at install time — lower supply-chain risk. However, package.json lists many dependencies (tensorflow/tfjs, brain.js, express, ws, multiple logging libs) and devDeps; installing or npm installing the package will fetch numerous third-party packages. Some entries look unusual for a pure offline converter (express/helmet/cors/compression), increasing the attack surface when performing npm install. The repo appears to expect Node >=18 but also references @microsoft/codeanalysis-csharp (a .NET analysis concept) which may not behave as expected in a Node environment — another install/runtime mismatch to verify.
Credentials
The skill does not request environment variables, credentials, or config paths. The runtime instructions operate on local project files, which is appropriate for the stated purpose. No secrets or external credentials are declared or required by SKILL.md.
Persistence & Privilege
The skill is not marked always:true and uses default autonomous invocation (normal). There is no evidence the skill attempts to modify other skills or agent-wide configuration. It writes generated code to user-specified output directories (expected behavior).
What to consider before installing
This package appears to implement a legitimate WinForms→Qt migration toolkit, but there are notable red flags you should address before running it on sensitive code:
1) Verify filenames and runtime commands: SKILL.md refers to scripts that are missing or named differently in the repo. Confirm which scripts exist and test them on a small sample project first to avoid surprises.
2) Review scripts for network/exec usage: Search all JS files for child_process.exec/execSync/spawn, axios/fetch/ws/express usage, and any hardcoded URLs or remote endpoints. If scripts attempt network calls, inspect what is sent and to where.
3) Inspect dependencies: The dependency list includes heavy ML libraries and several webserver packages. If you npm install, these will be fetched — consider auditing or installing in an isolated environment (container or VM). If you do not need the web/ML features, consider trimming or forking the repo.
4) Run in a sandbox: Execute the tools on non-sensitive sample projects first (or inside a disposable container) to validate behavior, output locations, and that no unexpected outbound traffic occurs.
5) Check build/runtime mismatches: Some referenced tooling (Roslyn/.NET analysis) may require .NET tooling rather than pure Node; confirm prerequisites and ensure you have the correct environment before running.
6) Confirm licensing and provenance: The source/origin is listed as unknown; verify the repository origin and maintainers, and review CHANGELOG/README claims (e.g., '100% zero compile errors') skeptically and validate with your own build tests.
If you want, I can (a) search the provided files for network or exec usage and summarize exact lines that matter, or (b) list missing script names and where SKILL.md and package.json diverge so you can fix or test safely.scripts/analyze_winforms.js:255
Shell command execution detected (child_process).
scripts/core/analyzer/RoslynAnalyzer.js:596
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk977qsbags2ffkkgbg1mcqw0js83cmcc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.