Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Auto Conda Env
v1.1.0自动为Python项目创建或复用匹配的Conda环境，扫描项目依赖文件自动配置运行环境。Auto-create or reuse a Conda env for any Python project — scans deps, matches envs, handles CUDA/GPU needs.
⭐ 0· 5·0 current·0 all-time
byKazuya@kazuya-ecnu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md behavior (search for and run conda, create/inspect conda envs, run pip installs) matches the described purpose. However, the declared required binaries list includes python3 and pip but does NOT declare conda even though the instructions depend heavily on conda. This is an inconsistency that could lead to unexpected failures or hidden assumptions about available tooling.
Instruction Scope
Instructions explicitly run conda commands, run pip installs (including installing pipenv), probe common home paths for conda, and suggest adding the --break-system-packages flag if pip is blocked. Recommending --break-system-packages is risky because it bypasses OS package protections and can alter system package state; running arbitrary pip installs from project files will fetch code from the network and execute package install scripts. The skill does not instruct exfiltration or contact unknown endpoints, but it grants broad discretion to run commands that change system state and install remote code.
Install Mechanism
No install spec — instruction-only with a tiny helper script. Nothing is written to disk by a packaged installer. This is the lower-risk pattern for a skill that delegates runtime behavior to the agent.
Credentials
The skill requests no credentials or environment variables, which is appropriate. It does, however, omit declaring the conda binary as required even though SKILL.md assumes its presence; that mismatch should be addressed. The network activity (pip installs, optional PyTorch wheel index URL) is expected for environment setup and does not require secrets, but you should be comfortable with arbitrary package installs coming from public registries.
Persistence & Privilege
always is false, no privileged or persistent installation is requested, and the skill does not attempt to modify other skills or system-wide agent settings. It only instructs creating/using conda envs in user space.
What to consider before installing
This skill appears to do what it claims, but take precautions before running it: (1) fix the metadata: conda should be declared as a required binary so the agent fails early if conda is absent; (2) do not blindly accept the recommendation to use --break-system-packages — understand the implications and only use it with explicit user consent; (3) review the project's dependency files yourself before allowing the skill to run pip/conda install (malicious packages can execute code at install time); (4) run the skill in a safe context (non-production machine or container) the first time to confirm behavior; (5) ensure the provided project path is correct to avoid unintended filesystem changes. If you need higher assurance, require explicit confirmations in SKILL.md before any network installs or system-modifying commands.Like a lobster shell, security has layers — review code before you run it.
latestvk9762w18j7h8rbnpt6fbz35bvs8496sq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🐍 Clawdis
Binspython3, pip