Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Peace Workflow

v1.0.0

和平之种 HTML 游戏的评审迭代工作流。自动发送文件、启动评审团评审、根据评审改进代码、生成新版本。触发词:peace workflow、和平工作流、HTML评审迭代、代码评审流程、自动迭代改进。使用场景:(1) 需要对 HTML 文件进行评审改进 (2) 需要启动多轮迭代优化 (3) 需要发送文件并获取评审反馈。

0· 113·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for kukuxnd/peace-workflow.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Peace Workflow" (kukuxnd/peace-workflow) from ClawHub.
Skill page: https://clawhub.ai/kukuxnd/peace-workflow
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install peace-workflow

ClawHub CLI

Package manager switcher

npx clawhub@latest install peace-workflow
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description and SKILL.md consistently describe an iterative HTML review-and-update workflow. However, the instructions expect a 'message' tool (channel: feishu) and a 'jury-review' skill to exist and be callable; those dependencies are not declared in the skill metadata. This omission is a design/information gap (not necessarily malicious) but reduces transparency about required capabilities and external recipients.
!
Instruction Scope
SKILL.md explicitly instructs the agent to read a user-specified file path, create new versioned files, and send files via the 'message' tool (Feishu) and to the 'jury-review' skill. Sending user files to external services/third-party reviewers is outside the agent's local context and may transmit sensitive data. There are no instructions in the document requiring explicit user confirmation, filtering/sanitization of sensitive content, or describing who the reviewers are or where data goes.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes disk/installation risk. No downloads or package installs are requested.
Credentials
The skill declares no required environment variables or credentials, which is consistent with an instruction-only workflow. However, because it instructs use of a Feishu channel and a separate 'jury-review' skill, practical execution will rely on platform-provided connectors/credentials; the SKILL.md does not document what credentials or scopes those connectors require or where reviewer endpoints live, creating a blind spot for data access/exfiltration risk.
Persistence & Privilege
The skill does not request always:true or other elevated persistent privileges. It does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default on the platform but is not itself unusual here.
What to consider before installing
This skill appears to do what it says (iterate on HTML files), but it instructs the agent to read files and send them out via a 'message' tool (Feishu) and to call a separate 'jury-review' skill without declaring those dependencies or explaining who receives the files. Before installing or using it: (1) confirm where files will be sent and who the reviewers are (Feishu channel owner, external services), (2) ensure the platform's message/jury-review connectors use credentials and recipients you trust, (3) avoid sending files that contain secrets or sensitive data (API keys, passwords, PII), (4) request the skill require explicit user confirmation before sending any file externally, and (5) ask the publisher to declare dependencies (message/jury-review) and data-retention/privacy details. These steps will reduce the risk of unintended data exposure.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f1rtp2ahr22xj7h440w6b3n83995b
113downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Peace Workflow - 评审迭代工作流

自动化 HTML 文件的评审、改进和交付流程。

工作流程

发送文件 → 启动评审 → 分析反馈 → 改进代码 → 生成新版本 → 发送结果

执行步骤

Step 1: 发送当前版本

将用户指定的 HTML 文件发送到对话中:

使用 message 工具发送文件
- channel: feishu
- action: send
- filePath: 用户指定的文件路径
- message: 简短说明

Step 2: 启动评审团

调用 jury-review 技能进行多维度评审:

前端/UI 项目核心评审团:

            【美术官】🎨
               ↓
【体验官】👁️ ─── 代码 ─── 【性能官】⚡
               ↓
            【兼容官】🔧

前端项目极端评审官推荐:

评审官挑战维度推荐理由
🔥 纵火官破坏性测试前端需要抵抗极端用户操作
🧟 僵尸官资源极限移动端内存有限
🌪️ 风暴官高压负载动画/交互堆积可能导致卡顿

默认全部加入极端评审官。

Step 3: 分析评审反馈

根据评审结果,重点关注:

性能官重点关注:

  • DOM 操作频率
  • 事件监听器数量
  • 内存泄漏风险
  • 对象池/复用机制

体验官重点关注:

  • 交互反馈(视觉/触觉/听觉)
  • 加载状态
  • 错误处理
  • 无障碍访问

兼容官重点关注:

  • 移动端适配
  • iOS Safari 特殊处理
  • safe-area 适配
  • 触屏事件优化

安全官重点关注:

  • XSS 防护
  • 输入验证
  • 外部资源加载

Step 4: 改进代码

根据评审反馈实施改进:

常见改进模式:

  1. 性能优化

    • 添加对象池复用 DOM 元素
    • 限制最大节点数
    • 使用 requestAnimationFrame
    • 防抖/节流处理
  2. 体验增强

    • 震动反馈 (navigator.vibrate)
    • 加载动画
    • 渐进式增强
  3. 兼容性修复

    • iOS safe-area CSS 变量
    • 触屏事件 passive 处理
    • backdrop-filter 前缀
  4. 稳定性保障

    • 空值检查
    • 异常捕获
    • 资源清理

Step 5: 生成新版本

创建新文件,版本号递增:

peace_2.html → peace_3.html → peace_4.html ...

文件头部添加版本说明注释:

<!-- 
  Version: X.X
  Changes: [改进要点列表]
  Review Score: [评审得分]
-->

Step 6: 发送结果

使用 message 工具发送新版本文件,附带改进说明。

配置参数

参数默认值说明
max_iterations3最大迭代次数
accept_threshold80接受阈值
version_prefixpeace文件名前缀

示例用法

用户: 把 peace_2.html 发送给我并启动评审,把结果写到 peace_3.html

Agent 执行:
1. 发送 peace_2.html
2. 启动评审团评审
3. 分析反馈(得分 73.2)
4. 实施改进(对象池、防抖、震动、safe-area)
5. 生成 peace_3.html
6. 发送 peace_3.html 并说明改进要点

注意事项

  • 评审得分 < 80 时建议继续迭代
  • 每轮迭代应有明确改进目标
  • 保持代码可读性和注释清晰
  • 记录版本变更历史

Comments

Loading comments...