Ai Autotester

Automates code testing by analyzing tasks, planning subtasks, executing tests, validating results, and providing detailed reports and summaries.

Security Scan

The skill's stated purpose (automated testing) fits the code, but the implementation has undocumented filesystem behavior (hardcoded workspace path, writes test files), performs network-capable package installs, and contains small bugs — these mismatches and side-effects warrant caution.

Purpose & Capability

The skill name/description (automated testing) aligns with the included run.py which prepares tests and runs pytest. However the code hardcodes a workspace path (/home/jason/.openclaw/workspace) and resolves the target relative to it unless an absolute path is provided. The SKILL.md does not mention this workspace assumption; that hardcoded path is unexpected and may not match the user's environment.

Instruction Scope

SKILL.md describes analyzing, planning, executing, and validating tests but does not disclose that the shipped run.py will: create a tests/ directory and write a test_smoke.py file into the target project, write a requirements-test.txt into the project, invoke pip to install requirements (both the project's requirements.txt and a created requirements-test.txt), and execute pytest. These are side effects (file writes, installs, executing arbitrary project code) that are not documented in SKILL.md.

Install Mechanism

There is no install spec; the skill is instruction-only plus a small Python helper. Nothing is downloaded by the skill manifest itself. The code does call pip at runtime to install packages, but that's runtime behavior rather than an installer provided by the skill bundle.

Credentials

The skill declares no required environment variables or config paths, yet the code implicitly depends on and writes under a hardcoded filesystem location (/home/jason/.openclaw/workspace). It will also run pip to pull packages from PyPI or remote URLs referenced in requirements.txt — granting network access to fetch arbitrary packages. Those capabilities are reasonable for running tests but are not reflected in the metadata or SKILL.md and therefore are disproportionate to the documented requirements.

Persistence & Privilege

always is false and the skill does not request persistent/system-wide privileges. It does modify the target project (creates tests/ and requirements-test.txt) which is expected for a test scaffold but should be considered a write operation to user files.

What to consider before installing

Before installing or running this skill: (1) Be aware that run.py will write files into the target project (tests/test_smoke.py and requirements-test.txt), run pip to install packages (which will reach out to PyPI or other URLs listed in requirements.txt), and execute pytest — so it will execute code from the target repository. (2) The script assumes a hardcoded workspace path (/home/jason/.openclaw/workspace) unless you pass an absolute path; this is undocumented and may not match your environment. (3) Running this against untrusted code can execute arbitrary/malicious code or cause network requests to attacker-controlled locations — run it inside an isolated container, sandbox, or CI runner with network restrictions. (4) The code contains a small bug (uses datetime.UTC which will raise an error) — expect potential runtime failures. Recommended actions: review the target project's requirements.txt for suspicious package sources, run the tester on a copy of the repo in an isolated environment, or request a version of the skill that accepts a configurable workspace path and documents the file-write and install behavior.

Purpose

自動化測試程式碼

Primary Agents

Tester

Notes

單獨測試或流程節點

Inputs

• task: 要執行的任務描述
• context: 額外上下文（可選）
• constraints: 限制條件（可選）

Outputs

• plan/result/report（依任務類型）
• logs/summary

Workflow (default)

1. Analyze task
2. Plan subtasks
3. Execute by role
4. Validate result
5. Return final summary

Safety

• 不執行破壞性操作，除非明確授權
• 外部動作（發送、部署到正式環境）需二次確認
• 記錄關鍵決策與錯誤