Skill Rating Comparator

自动搜索同类技能，按功能、代码、文档、评价、更新和安装六维度评分，生成对比报告和优化建议。

Security Scan

The skill's stated purpose (compare and score other skills) matches the code and docs, but there are multiple incoherences and a prompt-injection indicator in SKILL.md that warrant caution before installing or running it.

Purpose & Capability

Name/description, SKILL.md and source code are aligned: the package is intended to find skills on ClawHub/GitHub and produce multi‑dimension comparison reports. However there are inconsistencies: SKILL.md lists runtime dependencies (node-fetch, cheerio) that do not appear in package.json, the implementation uses mock data and TODO comments instead of real API calls, and the package is described as 'instruction-only' despite including runnable source and tests. These mismatches are not necessarily malicious but are unexpected and reduce confidence in the implementation.

Instruction Scope

SKILL.md instructs the agent to search ClawHub and GitHub and to analyze SKILL.md/README/code of target skills — which is appropriate for this tool. The instructions do not ask the agent to read unrelated system files or request unrelated credentials. However the SKILL.md contains a detected 'unicode-control-chars' injection signal (see scan findings) that could attempt to manipulate downstream prompt processing; this needs review.

Install Mechanism

There is no install spec (no downloads or extract steps) which is lower risk. The repository includes source and package.json, but no runtime dependencies are declared for node-fetch/cheerio even though SKILL.md mentions them. Installing/building the package in your environment would involve running npm install/build; that is standard but verify declared dependencies before running.

Credentials

The skill declares no required environment variables or credentials (primary credential: none), which is proportionate for a public web-scraping/analysis tool. In practice a production implementation that calls GitHub or ClawHub APIs may need tokens (not requested here). Absence of credential requests is safer, but also suggests the shipped code currently uses mock data / is incomplete.

Persistence & Privilege

always: false (normal). The skill does not request persistent system privileges or to modify other skills. No indication it will force-enable itself or alter agent/global configs.

Scan Findings in Context

[unicode-control-chars] unexpected: The SKILL.md was flagged for Unicode control/hidden characters. This is not expected for a normal README/SKILL.md and can be used to manipulate prompt parsing or hide content. It should be inspected (show invisible characters) and removed if found. The rest of the codebase does not obviously rely on hidden control characters.

What to consider before installing

This skill appears to implement a legitimate feature (compare skills on ClawHub/GitHub), but there are several red flags you should consider before installing or running it: - Inspect SKILL.md and README for hidden/unicode control characters. These can be used to manipulate prompts; if present, remove them or reject the package. - Review the source locally. The implementation currently uses mock data and TODOs instead of real API calls; if you expect production behavior, ask the author for a complete implementation or inspect code paths that fetch external data. - Check package.json and declared dependencies. SKILL.md lists node-fetch and cheerio but they are not in package.json; installing/building could fail or the author may expect the runtime to provide them. Add only trusted dependencies and run npm audit before installing. - Because the skill interacts with external services (GitHub/ClawHub), consider running it in a sandboxed environment (container) first to observe network behavior and avoid exposing local files. - If you want full functionality, confirm whether the skill will require API credentials (GitHub token, ClawHub token) and only provide least-privilege tokens with appropriate scope. The current package does not request credentials, but a future/complete implementation likely will. If you are not comfortable reviewing code or handling hidden characters, prefer a skill from a known author or an official marketplace listing with clear provenance.

Skill 评分对比工具 - 自动对比同类型 Skill，生成多维度评分报告

功能

• 🔍 自动发现 - 搜索 ClawHub 和 GitHub 上的同类 Skill
• 📊 多维评分 - 6 大维度打分 (功能/代码/文档/评价/更新/安装)
• 📈 对比报告 - 雷达图可视化 + 优劣势分析
• 💡 推荐建议 - 基于评分给出选用建议

使用方法

基础用法

对比 skill-rating-comparator 和同类 Skill
评分对比 feishu-ai-coding-assistant
分析这个 Skill 的竞争力

高级用法

对比 skill-rating-comparator --platform=clawhub,github
评分 feishu-multi-agent-manager --dimensions=功能，代码，文档
生成 Skill 对比报告 --output=markdown

配置

在 OpenClaw 配置中添加：

skills:
  skill-rating-comparator:
    platforms:
      - clawhub
      - github
    dimensions:
      - 功能完整性
      - 代码质量
      - 文档完善度
      - 用户评价
      - 更新频率
      - 安装便捷性
    weights:
      功能完整性：0.25
      代码质量：0.20
      文档完善度：0.15
      用户评价：0.15
      更新频率：0.15
      安装便捷性：0.10

输出示例

## 📊 Skill 评分对比报告

**目标 Skill:** skill-rating-comparator
**对比对象:** 5 个同类 Skill

### 综合评分
| Skill | 综合得分 | 排名 |
|-------|---------|------|
| skill-rating-comparator | 8.7 | 🥇 1 |
| skill-analyzer-pro | 7.9 | 🥈 2 |
| skill-compare-tool | 7.2 | 🥉 3 |

### 维度对比
- 功能完整性：⭐⭐⭐⭐⭐ (9/10)
- 代码质量：⭐⭐⭐⭐☆ (8/10)
- 文档完善度：⭐⭐⭐⭐⭐ (9/10)
- 用户评价：⭐⭐⭐⭐☆ (8/10)
- 更新频率：⭐⭐⭐⭐☆ (8/10)
- 安装便捷性：⭐⭐⭐⭐⭐ (9/10)

### 优势
✅ 功能最全面，支持多平台对比
✅ 文档详细，示例丰富
✅ 更新活跃，每周迭代

### 劣势
⚠️ 用户基数较小，评价数量有限
⚠️ 安装步骤稍复杂

### 推荐建议
如果你是...
- 个人开发者 → 推荐使用 skill-rating-comparator
- 团队使用 → 推荐使用 skill-analyzer-pro
- 需要快速部署 → 推荐使用 skill-compare-tool

API

评分接口

interface SkillRating {
  skillId: string;
  name: string;
  platform: 'clawhub' | 'github';
  scores: {
    functionality: number;      // 功能完整性
    codeQuality: number;        // 代码质量
    documentation: number;      // 文档完善度
    userReviews: number;        // 用户评价
    updateFrequency: number;    // 更新频率
    installation: number;       // 安装便捷性
  };
  totalScore: number;
  rank: number;
}

对比接口

interface ComparisonReport {
  targetSkill: SkillRating;
  competitors: SkillRating[];
  summary: {
    strengths: string[];
    weaknesses: string[];
    recommendations: string[];
  };
  radarData: number[][];  // 雷达图数据
}

依赖

• @openclaw/sdk (运行时提供)
• node-fetch (HTTP 请求)
• cheerio (HTML 解析，可选)

开发说明

评分算法

每个维度 0-10 分，加权计算总分：

总分 = Σ(维度分 × 权重)

权重默认：
- 功能完整性：25%
- 代码质量：20%
- 文档完善度：15%
- 用户评价：15%
- 更新频率：15%
- 安装便捷性：10%

数据来源

1. ClawHub API - 下载量、评分、评论
2. GitHub API - Star、Fork、Issue、更新频率
3. 代码分析 - TypeScript 编译、代码规范
4. 文档分析 - README 完整度、示例数量

版本

• v1.0.0 - 初始版本，基础评分对比功能

作者

OpenClaw Skill 大师 ⚡

许可证

MIT