Crayfish Plugin Assistant

OpenClaw 插件开发助手，输出可运行的插件骨架、安装命令和调试步骤。

Security Scan

This is an instruction-only plugin development assistant whose inputs, outputs, and requirements are consistent with its stated purpose and do not request extra credentials, installs, or elevated privileges.

Purpose & Capability

The SKILL.md and metadata align with the advertised purpose: generating OpenClaw plugin/skill skeletons, installation and debugging commands. The skill declares no binaries, no env vars, and no install steps — all proportional to an authoring helper.

Instruction Scope

The instructions ask the agent to emit fully copy-pastable shell commands, package files, and publish/rollback steps. This is appropriate for a developer assistant, but those produced commands and generated files should be reviewed before execution because they may alter the system (install packages, write files, run scripts). The SKILL.md does not instruct the agent to read arbitrary local files or external credentials.

Install Mechanism

No install specification and no code files are included; the skill is instruction-only so it will not write or execute code as part of installation.

Credentials

The skill requests no environment variables or credentials. There is no indication it needs access to unrelated services or secrets.

Persistence & Privilege

always is false and model invocation is allowed (the platform default). The skill does not request persistent presence or system configuration changes.

Scan Findings in Context

[no-findings] expected: Regex-based scanner found nothing — expected because this is an instruction-only skill with no code files to analyze.

Assessment

This skill appears coherent and safe as an authoring assistant, but treat its outputs (shell commands, install/publish steps, generated package.json or scripts) as untrusted until you inspect them. Before running commands it emits: (1) preview generated files and check for malicious scripts or unexpected dependencies; (2) run install/publish commands in a sandbox, container, or a git branch so you can roll back; (3) avoid blindly pasting commands that modify system files or use sudo; and (4) if you plan to publish packages, review the npm package metadata and scripts for postinstall or publish hooks. If you want higher assurance, ask the agent to explain each command it proposes and to provide a non-destructive dry-run sequence first.

OpenClaw 插件开发助手（小龙虾）

你是 OpenClaw 插件工程助手，目标是让用户用最少命令把插件跑起来并可发布。

任务目标

1. 根据用户目标，判断应做 Skill 还是 Plugin（npm 包）。
2. 生成最小可运行插件骨架（含 package.json、openclaw.plugin.json、入口文件）。
3. 给出一键安装命令和回滚命令。
4. 给出本地调试命令和常见报错排查。

决策规则

• 如果用户只需要 prompt/流程增强，优先建议 Skill。
• 如果用户需要代码执行、工具调用或能力扩展，建议 Plugin。

输出格式

按以下结构输出：

• 方案类型：Skill / Plugin
• 目录结构：
• 关键文件：
• 安装命令：
• 调试命令：
• 发布命令：
• 回滚命令：
• 风险与排查：

约束

• 命令可直接复制执行。
• 对版本号使用 semver。
• 不输出与任务无关的背景说明。