Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Roo Code

v1.0.0

Roo Code AI 编程助手,精通 VS Code 内 AI Agent、多模式切换、MCP 集成

0· 126·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhangifonly/roo-code.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Roo Code" (zhangifonly/roo-code) from ClawHub.
Skill page: https://clawhub.ai/zhangifonly/roo-code
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install roo-code

ClawHub CLI

Package manager switcher

npx clawhub@latest install roo-code
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes a VS Code extension agent that performs file I/O, runs shell commands, and integrates MCP tools — that purpose is plausible. However, the skill bundle is instruction-only (no code, no install spec) and declares no required env vars or binaries even though the instructions show use of VS Code, npx, and environment tokens (e.g., GITHUB_TOKEN). Also the suggested extension id (RooVeterinaryInc.roo-cline) does not obviously match the skill name, which is a minor mismatch.
!
Instruction Scope
The runtime instructions encourage actions with broad scope: editing project files (.roomodes), reading .vscode/mcp.json, running npx to spawn MCP servers, and executing shell commands. Those capabilities can read and transmit project contents or run arbitrary packages. The SKILL.md also shows env interpolation (e.g., ${env:GITHUB_TOKEN}) even though no credentials are declared, which is a scope/authority gap.
Install Mechanism
There is no formal install spec (lowest platform install risk). However, the instructions tell users to install a VS Code extension via the marketplace and to run 'npx -y' to fetch MCP packages at runtime — both will pull third-party code from registries when used and could introduce risk depending on the package source.
!
Credentials
The skill's declared metadata requests no env vars, yet the documentation explicitly demonstrates using credentials (GITHUB_TOKEN, API keys for OpenAI/Anthropic/etc.). This mismatch is concerning: the skill expects or suggests secrets will be used, but does not declare or justify them in the metadata, increasing the chance of accidental credential exposure if users follow examples without understanding implications.
Persistence & Privilege
The skill is not forced always-on and is user-invocable; autonomous model invocation is enabled but that's the platform default. The skill does not request persistent platform privileges in its manifest.
What to consider before installing
This skill describes a powerful VS Code AI agent but is provided only as instructions (no code) and contains a few mismatches. Before installing or following its examples: (1) verify the extension’s publisher and extension id in the official VS Code Marketplace rather than running the shown CLI blindly, (2) never paste or provision secrets (GITHUB_TOKEN, OpenAI keys, etc.) unless you trust the publisher and understand what will access them, (3) be cautious about running npx commands that fetch packages at runtime—prefer pinned, official package releases, (4) review any .roomodes or .vscode/mcp.json files in a safe environment to see what external tools/APIs are being invoked, and (5) if you want to try it, test in an isolated project or VM with no sensitive data. The inconsistencies here are not proof of malice but do warrant caution.

Like a lobster shell, security has layers — review code before you run it.

latestvk979s4ntq8qqj6qskpnkr0nay183dtvf
126downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Roo Code - VS Code 内的 AI 编程 Agent

简介

Roo Code(原名 Roo Cline,fork 自 Cline)是一款 VS Code 扩展,能在编辑器内自主执行多步编程任务。 它不只是代码补全——而是一个真正的 AI Agent,可以读写文件、执行终端命令、浏览网页、调用 MCP 工具。

核心功能

  • 自主多步执行:理解需求后自动规划步骤,逐步执行文件创建/修改/删除
  • 文件读写:直接在编辑器中创建和修改文件,带 diff 预览确认
  • 终端命令执行:运行 shell 命令(安装依赖、运行测试、启动服务等)
  • 浏览器集成:内置浏览器可截图查看页面效果,辅助前端开发
  • MCP Server 集成:连接外部工具服务器,扩展 AI 能力边界
  • 上下文提及(@):用 @file @folder @url 精确引用上下文

多模式系统

Roo Code 内置多种工作模式,每种模式有不同的系统提示词和工具权限:

模式用途可用工具
Code日常编码(默认)文件读写 + 终端 + 浏览器
Architect架构设计与规划只读文件 + 分析(不修改代码)
Ask问答与代码解释只读文件(不执行任何操作)
Debug调试与问题排查文件读写 + 终端 + 日志分析

切换模式:在聊天输入框顶部点击模式按钮,或在对话中输入 @mode code

自定义模式(.roomodes)

在项目根目录创建 .roomodes 文件定义团队专属模式:

{
  "customModes": [
    {
      "slug": "reviewer",
      "name": "Code Reviewer",
      "roleDefinition": "你是一位严格的代码审查员,关注安全性、性能和可维护性。",
      "groups": ["read"],
      "source": "project"
    },
    {
      "slug": "tester",
      "name": "Test Writer",
      "roleDefinition": "你是测试工程师,擅长编写全面的单元测试和集成测试。",
      "groups": ["read", "edit", "command"],
      "source": "project"
    }
  ]
}

MCP Server 集成

Roo Code 支持通过 MCP(Model Context Protocol)连接外部工具:

// .vscode/mcp.json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@anthropic/mcp-filesystem"]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@anthropic/mcp-github"],
      "env": { "GITHUB_TOKEN": "${env:GITHUB_TOKEN}" }
    }
  }
}

配置后 AI 可直接调用这些工具完成 GitHub 操作、数据库查询等任务。

支持的模型

供应商模型说明
AnthropicClaude Sonnet/Opus官方推荐,效果最佳
OpenAIGPT-4o / o1通过 API Key 配置
GoogleGemini 2.0 Flash/Pro免费额度较多
DeepSeekDeepSeek V3/R1高性价比
Ollama本地模型离线使用,隐私安全
OpenRouter聚合多模型一个 Key 用所有模型

与同类工具对比

特性Roo CodeClineCursorGitHub Copilot
开源是(Apache 2.0)
Agent 能力强(多步自主)
自定义模式支持 .roomodes不支持不支持不支持
MCP 集成原生支持原生支持不支持不支持
模型自由度任意模型任意模型限定模型限定模型
更新频率极高(社区活跃)较高

典型使用场景

  • 全栈开发:Code 模式下一次对话完成前后端功能开发
  • 架构评审:Architect 模式分析项目结构,输出改进建议
  • 自动化调试:Debug 模式读取错误日志,定位并修复问题
  • 项目初始化:从零搭建项目骨架,包括配置文件和目录结构
  • MCP 扩展:连接数据库/API/文件系统等外部工具完成复杂任务

安装

在 VS Code 扩展市场搜索 "Roo Code" 安装,或命令行:

code --install-extension RooVeterinaryInc.roo-cline

Comments

Loading comments...