Security audit
Security checks across malware telemetry and agentic risk
This skill is a legitimate publishing helper, but it can automatically change files, commit and push to Git, publish to ClawHub, and contains an unsafe shell-command pattern users should review before installing.
Install only if you intend to automate publishing and are comfortable with the skill changing local files, committing, pushing to the configured Git remote, and publishing to ClawHub. Review diffs and targets first, avoid passing untrusted changelog or commit text into the script, prefer the skip flags or manual publish steps for sensitive repositories, and avoid the force-push troubleshooting path unless you fully control the branch.
def run_cmd(cmd, cwd=None):
"""执行 shell 命令"""
print(f"🔧 执行：{cmd}")
result = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=True, text=True)
if result.stdout:
print(result.stdout.strip())
if result.returncode != 0 and result.stderr:66/66 vendors flagged this skill as clean.
No suspicious patterns detected.