Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Six Dim Evaluator

v0.1.0

L4 评估层 - 六维评估引擎。自动化执行六维评估(T/C/O/E/M/U),生成评估报告,提供改进建议。

0· 70·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for pagoda111king/six-dim-evaluator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Six Dim Evaluator" (pagoda111king/six-dim-evaluator) from ClawHub.
Skill page: https://clawhub.ai/pagoda111king/six-dim-evaluator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install six-dim-evaluator

ClawHub CLI

Package manager switcher

npx clawhub@latest install six-dim-evaluator
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
SKILL.md claims the tool will query the ClawHub API, analyze usage logs, run Jest tests, save evaluation data to a database, and send alerts; however the code in src/index.js only reads local files (README.md, SKILL.md, tests, CHANGELOG.md) and computes heuristic scores using hard-coded placeholders. There are no network calls, no DB code, and no declared environment variables for external services. This mismatch means either the documentation over-promises functionality or required runtime secrets/capabilities are missing/undeclared.
!
Instruction Scope
The runtime instructions (SKILL.md) direct the agent to run tests, query ClawHub API, analyze logs, generate visualizations, and persist data — actions that can require shell execution, network access, and credentials. The implementation, however, only inspects files under a given skill path and uses placeholder values (e.g., fixed testCoverage). The instructions are broader and vaguer than the code, and mention tools (Bash/Exec) and external endpoints without specifying required permissions or env vars.
Install Mechanism
There is no install specification (instruction-only skill), so nothing will be downloaded automatically by the platform. The package includes package.json and a package-lock.json with normal dependencies (commander, jest devDeps and large dev dependency tree). Because there is no automated installer specified, installing or running the node package would be a manual step — lower platform risk — but review of package-lock is advisable before running npm install from an untrusted source.
!
Credentials
SKILL.md describes interactions that normally require credentials (ClawHub API access, a database for persisted evaluations, alerting/notification targets), yet requires.env and primary credential are empty. The implementation does not use or request any env vars, which is inconsistent with the documented external integrations. This gap could mean missing declarations, or that later changes/versions might request secrets unexpectedly.
Persistence & Privilege
The skill does not request permanent presence (always: false), does not declare config paths or system-wide modifications, and the code does not modify other skills or global agent settings. Autonomous invocation is allowed by default (platform normal) but not combined with other high-risk attributes here.
What to consider before installing
This package is internally inconsistent: the documentation promises external integrations (ClawHub API, DB storage, log analysis, alerts) but the code only performs local file inspection with placeholder values. Before installing or running it: 1) Ask the author for the source repository and verify provenance (public git, commit history). 2) Confirm what external APIs/databases it will call and require explicit env var names and scopes (ClawHub API key, DB credentials). 3) Inspect package-lock.json for unexpected/obfuscated dependencies and run npm install only in a sandbox. 4) Run the code locally in a safe environment to verify behavior (no network connections, no writes to unexpected locations). 5) If you plan to allow the agent to execute shell or network actions on your behalf, only grant minimal, documented credentials and prefer short-lived credentials or scoped tokens. Because of the mismatch between docs and code, treat this skill as untrusted until the author clarifies intended external integrations and provides verifiable source.

Like a lobster shell, security has layers — review code before you run it.

latestvk979g0rvbmpr0q36j2mzdwyea184aftv
70downloads
0stars
1versions
Updated 3w ago
v0.1.0
MIT-0

Six-Dim Evaluator - 六维评估器

版本: v0.1.0
定位: L4 评估层 - 六维评估引擎
状态: 🆕 新创建


📖 技能说明

Six-Dim Evaluator 是一款自动化六维评估工具,通过量化指标自动评估技能的 T/C/O/E/M/U 六个维度,生成详细评估报告,并提供改进建议。

核心价值:

  • 自动化评估流程(0.1h/技能)
  • 量化评分标准(100% 可验证)
  • 改进建议生成(AI 驱动)
  • 趋势分析预测(基于历史数据)

🎯 使用场景

场景类型示例问题
技能评估「请评估 first-principle-analyzer 的六维得分」
版本对比「对比 v0.1.0 和 v0.2.0 的六维变化」
改进建议「如何提升 skill-composer-pro 的 M 维度?」
趋势分析「分析 skill-health-monitor 的评分趋势」

🚀 使用方法

方式 1:单技能评估

请评估以下技能:
技能:skill-composer-pro
版本:0.1.0

方式 2:批量评估

请批量评估以下技能:
技能列表:skill-1, skill-2, skill-3

方式 3:版本对比

请对比以下版本:
技能:skill-discoverer-pro
版本 1:0.1.0
版本 2:0.2.0

方式 4:改进建议

请提供改进建议:
技能:first-principle-analyzer
目标维度:M(商业化)
目标分数:0.80

📋 核心功能

1. 自动化评估

评估流程:

1. 数据采集
   ├─ 运行 Jest 测试(T 维度)
   ├─ 分析代码质量(T 维度)
   ├─ 检查文档完整度(U 维度)
   ├─ 查询 ClawHub API(M 维度)
   └─ 分析使用日志(E 维度)

2. 评分计算
   ├─ 子维度评分(24 项)
   ├─ 维度评分(6 项)
   └─ 综合评分(加权平均)

3. 报告生成
   ├─ Markdown 报告
   ├─ JSON 数据
   └─ 可视化图表

2. 版本对比

对比维度:

  • 六维得分变化
  • 子维度变化
  • 排名变化
  • 改进/退化项

3. 改进建议生成

建议类型:

  • T 维度:测试覆盖提升、代码质量优化
  • C 维度:实战案例添加、思维框架完善
  • O 维度:API 优化、技能协作示例
  • E 维度:反馈收集、版本历史
  • M 维度:ClawHub 上架、用户反馈
  • U 维度:FAQ 完善、快速开始指南

4. 趋势分析

分析内容:

  • 历史评分趋势(折线图)
  • 预测未来评分(线性回归)
  • 异常检测(Z-Score)
  • 告警通知(评分异常)

📊 六维评估

维度目标证据改进方向
T(技术深度)0.80评估算法 + 自动化持续优化算法
C(认知增强)0.75评估框架文档增加案例
O(编排能力)0.85与其他技能集成生态协同
E(进化能力)0.75评估反馈收集自动优化
M(商业化)0.70评估即服务用户增长
U(用户体验)0.75评估报告可视化交互增强
平均0.77-A 级

🔗 相关技能

  • skill-health-monitor - 被评估技能
  • skill-evolver - 评估结果用于进化
  • meta-skill-weaver - 评估流程编排

📝 版本历史

v0.1.0 (2026-04-07) - 初始版本

  • 自动化评估功能
  • 版本对比功能
  • 改进建议生成
  • 趋势分析功能

💡 使用技巧

技巧 1:评估前准备

确保技能有以下材料:

  • 完整源代码
  • 测试覆盖率报告
  • 文档(README + FAQ)
  • ClawHub 上架信息

技巧 2:解读评估报告

关注关键指标:

  • 综合评分(是否达标)
  • 短板维度(需要改进)
  • 改进建议(可执行性)

技巧 3:持续追踪

定期评估(建议每周):

  • 追踪评分趋势
  • 验证改进效果
  • 调整改进策略

🐛 已知局限

  1. 评估准确性 - 依赖数据质量,需人工审核
  2. 技能覆盖 - 仅支持已注册技能
  3. M 维度评估 - 依赖 ClawHub API 稳定性

❓ FAQ

Q1: 评估需要多长时间?

A: 单个技能约 5-10 分钟(自动化),批量评估约 30 分钟。

Q2: 评估结果准确吗?

A: 自动化评估准确率约 85%,建议人工审核关键评分。

Q3: 如何申诉评估结果?

A: 可通过 feedback-collector 提交申诉,评估委员会 7 天内复审。

Q4: 评估数据会保存吗?

A: 是的,评估数据会保存到评估数据库,用于趋势分析。


📁 项目结构

six-dim-evaluator/
├── SKILL.md                 # 技能定义
├── README.md                # 本文档
├── package.json             # 项目配置
├── src/
│   ├── index.js            # 主入口
│   ├── evaluate.js         # 评估引擎
│   ├── compare.js          # 版本对比
│   ├── suggest.js          # 建议生成
│   └── trend.js            # 趋势分析
├── tests/
│   └── evaluate.test.js    # 评估测试
└── examples/
    └── reports.md          # 评估报告示例

📞 支持


创建时间: 2026-04-07
最新版本: v0.1.0
ClawHub 上架: 待上架
维护者: 王的奴隶 · 严谨专业版
许可证: MIT


💰 购买与授权

个人版: $79.9(永久使用 + 1 年更新)
商业版: $299.9(商业用途 + 优先支持)
企业版: $799.9(定制部署 + 培训)

购买方式: 访问 ClawHub 技能页面


☕ 支持作者

如果这个技能对你有帮助,欢迎赞助:

  • 爱发电:afdian.net/@cloud-shrimp(待设置)
  • 微信赞赏:[待添加]

你的支持让我能持续改进技能!

Comments

Loading comments...