Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Swiftverify

v1.0.0

Apple Design Award 标准的 Swift/SwiftUI 项目验证技能。执行编译、架构、设计系统、无障碍、国际化、性能、原生集成七层检查,生成综合报告。

0· 86·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for soponcd/swiftverify.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Swiftverify" (soponcd/swiftverify) from ClawHub.
Skill page: https://clawhub.ai/soponcd/swiftverify
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install swiftverify

ClawHub CLI

Package manager switcher

npx clawhub@latest install swiftverify
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's purpose (compile and verify Swift/SwiftUI projects using xcodebuild, swiftlint, Instruments, XCTest, etc.) is plausible, but the registry metadata declares no required binaries or environment and there are no code/script files in the package even though the SKILL.md references many scripts and resources. A verification skill would legitimately need those tools and scripts, so their absence is an incoherence.
!
Instruction Scope
The runtime instructions tell the agent to run repository scripts (e.g., ./agent/skills/swiftverify/scripts/run_all.sh) that would compile, inspect, and auto-modify project source. The package does not include those scripts or the referenced resource files. Instructions allow automatic code fixes (auto-fix) which modify source without describing safeguards, and paths are inconsistently referenced (.agent vs ./agent). Running these steps would give the agent the ability to read and change project files—expected for this task but not documented in the package.
Install Mechanism
There is no install spec (instruction-only), which is low-risk by itself. However, SKILL.md assumes on-disk scripts and tools that are not present in the manifest. This suggests the SKILL.md represents a design or CI snippet rather than an actually packaged skill—users should not assume the missing artifacts are present or safe.
!
Credentials
The skill declares no required environment variables or credentials, yet its checks (xcodebuild, signing, Instruments) commonly require macOS tooling, developer certificates, or CI secrets. Also auto-fix will write changes to repo files without stating required permissions. The absence of declared env/config requirements is disproportionate to the described operations.
Persistence & Privilege
always:false and normal model invocation are set (no privileged always-on behavior). The main privilege to note is that the described scripts would read and modify repository files; this is an expected capability for a verification/auto-fix tool but the package does not include the scripts to review beforehand, increasing risk. No evidence the skill would modify agent/global settings.
What to consider before installing
Do not run or install this skill as-is. The SKILL.md expects many scripts and resource files (scripts/, templates/, resources/) that are not included in the package manifest, and it references tools (xcodebuild, swiftlint, Instruments, XCTest) and auto-fix operations without declaring required binaries, credentials, or safeguards. Before using: 1) obtain and review the actual scripts and resource files that SKILL.md references; 2) verify exactly what commands the scripts run (especially any code-modifying auto-fix steps) and run them in an isolated environment or CI runner with repository backups; 3) confirm required binaries/OS (this requires macOS with Xcode and Instruments) and any signing/dev account usage; 4) ensure no secrets (Apple IDs, certs) are needed or, if they are, that their use is explicit and minimal; 5) ask the publisher for the missing artifacts or use the linked GitHub homepage to inspect the real repository. The current package looks like a plan or CI snippet rather than a complete, reviewable skill—treat it as untrusted until the missing files are provided and inspected.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Clawdis
latestvk97f10vfq39qnh0t37q8h8990s83n5qw
86downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

SwiftVerify: Apple 原生应用质量验证技能 (v1.0)

核心任务: 确保代码达到 Apple Design Award 评审标准 (执行 ./tools/quality_gate.sh full)。 执行频率: 每次 Feature 完成后、PR 合并前、发布前必须执行。

技能目录结构

├── scripts/
│   ├── run_all.sh                # 入口脚本
│   ├── check_build.sh            # Step 1: 编译
│   ├── check_architecture.sh     # Step 2: 架构
│   ├── check_design_tokens.sh    # Step 3: 设计
│   ├── check_a11y.sh             # Step 4: 无障碍
│   ├── check_i18n.sh             # Step 5: 国际化
│   ├── check_performance.sh      # Step 6: 性能
│   ├── check_native.sh           # Step 7: 原生
│   └── check_tests.sh            # Step 8: 测试

## 技能拓扑图 (Topology)

```mermaid
graph TD
    User[用户 / CI] -->|调用| RunAll[run_all.sh]
    
    subgraph "Verification Steps"
        RunAll --> Build[1. Build & Lint]
        RunAll --> Arch[2. Architecture]
        RunAll --> Tokens[3. Design Tokens]
        RunAll --> A11y[4. Accessibility]
        RunAll --> I18n[5. i18n]
        RunAll --> Perf[6. Performance]
        RunAll --> Native[7. Native Integration]
        RunAll --> Tests[8. Unit Tests]
    end
    
    subgraph "Dependencies"
        Build --> Xcode[xcodebuild]
        Build --> SwiftLint[swiftlint]
        Tests --> XCTest[XCTest]
        Arch --> Grep[grep/awk]
    end
    
    subgraph "Rules"
        RunAll -.-|quality_gate.sh| Tools[Project Tools]
    end

│ ├── check_build.sh # Step 1: 编译检查 │ ├── check_architecture.sh # Step 2: 架构漂移检测 │ ├── check_design_tokens.sh # Step 3: 设计系统合规 │ ├── check_a11y.sh # Step 4: 无障碍检查 │ ├── check_i18n.sh # Step 5: 国际化检查 │ ├── check_performance.sh # Step 6: 性能基准 (需手动) │ ├── check_native.sh # Step 7: 原生集成检查 │ └── run_all.sh # 一键执行全部检查 ├── templates/ │ └── verification_report.md # 报告模板 └── resources/ └── ada_checklist.md # Apple Design Award 检查清单


---

## 1. 执行流程 (Execution Protocol)

### 快速验证 (Quick Check)
```bash
./agent/skills/swiftverify/scripts/run_all.sh

完整验证 (Full Check)

按顺序执行以下检查,任一失败则阻断:

Step脚本验证内容阻断级别
1check_build.sh编译通过 + SwiftLint🔴 HARD
2check_architecture.shMVVM+ 分层 + 依赖方向🔴 HARD
3check_design_tokens.shToken 使用率 100%🟡 SOFT
4check_a11y.sh无障碍标签覆盖🟡 SOFT
5check_i18n.sh字符串本地化 100%🟡 SOFT
6check_performance.sh性能基准 (手动)🟢 INFO
7check_native.sh原生集成验证🟢 INFO
8check_tests.shUnit Tests (XCTest)🟡 SOFT

2. 检查详情 (Check Details)

无障碍参考

swiftverify 整合了完整的无障碍检查指南。详见 resources/accessibility-checklist.md

自动检查项

  • ✅ VoiceOver 标签缺失检测
  • ✅ 硬编码字号检测(破坏 Dynamic Type)
  • ✅ Reduce Motion 适配提示
  • ✅ 空标签或占位符标签检测
  • ✅ 触控目标大小验证

执行检查

./scripts/check_a11y.sh

Step 1: 编译检查 (Build Check)

文件: scripts/check_build.sh

检查项标准状态
xcodebuild 编译EXIT 0HARD
SwiftLint0 ErrorHARD
生命周期激活所有 Service 启动HARD

Step 2: 架构漂移检测 (Architecture Drift)

文件: scripts/check_architecture.sh

检查项验证规则状态
View 层隔离Views/ 不 import SwiftDataHARD
Model 层隔离Models/ 不 import SwiftUIHARD
Sendable 符合所有 Model 实现 SendableHARD
GCD 禁用无 DispatchQueueHARD

Step 3: 设计系统合规 (Design System Compliance)

文件: scripts/check_design_tokens.sh

检查项验证规则状态
硬编码颜色Color(#...).redSOFT
硬编码数值.padding(16)SOFT
标准圆角使用 DesignTokens.CornerRadiusSOFT
标准间距使用 DesignTokens.SpacingSOFT

Step 4: 无障碍检查 (Accessibility)

文件: scripts/check_a11y.sh

检查项验证规则状态
accessibilityLabel所有 Button/Image 有标签SOFT
触控区域交互元素 ≥ 44x44 ptSOFT
动态字体.font(.system(size:))SOFT

Step 5: 国际化检查 (Internationalization)

文件: scripts/check_i18n.sh

检查项验证规则状态
字符串本地化使用 String(localized:)SOFT
无硬编码中文Text("中文") 需替换SOFT

Step 6: 性能检查 (Performance)

文件: scripts/check_performance.sh

检查项工具标准
启动时间Instruments< 400ms
内存泄漏Instruments Leaks0
主线程阻塞Main Thread Checker0

⚠️ 性能检查需要手动运行 Instruments

Step 7: 原生集成检查 (Native Integration)

文件: scripts/check_native.sh

检查项验证规则状态
AppIntent 存在Intents/ 目录非空INFO
Shortcuts 注册AppShortcutsProvider 存在INFO

Step 8: 单元测试 (Unit Tests)

文件: scripts/check_tests.sh

检查项验证规则状态
Unit Tests如果存在测试 Target,必须全部通过SOFT
Code Coverage(可选) 输出覆盖率报告INFO

3. 报告生成 (Report Generation)

执行完成后,在 specs/verification_report.md 生成报告:

# 验证报告 - [日期]

## 总体状态: ✅ PASS / ❌ FAIL

| 检查维度 | 状态 | 违规数 |
|----------|------|--------|
| 编译检查 | ✅ | 0 |
| 架构一致性 | ✅ | 0 |
| 设计系统 | ⚠️ | 3 |
| 无障碍 | ⚠️ | 5 |
| 国际化 | ✅ | 0 |
| 性能 | ⏳ | - |
| 原生集成 | ✅ | 0 |
| 单元测试 | ✅ | 0 |

## 违规详情
...

4. 自动修复 (Auto-Fix)

对于 SOFT 级别的违规,提供自动修复建议:

违规类型自动修复方法
硬编码字符串替换为 String(localized: "key")
硬编码数值替换为 DesignTokens.Spacing.xxx
缺少 a11y 标签添加 .accessibilityLabel()

5. 与 CI/CD 集成

# GitHub Actions 示例
- name: SwiftVerify
  run: |
    chmod +x .agent/skills/swiftverify/scripts/run_all.sh
    .agent/skills/swiftverify/scripts/run_all.sh

6. 安全阻断 (Safety)

  • HARD 级别失败:必须修复后才能继续
  • SOFT 级别失败:可继续但需记录 Tech Debt
  • INFO 级别失败:仅供参考

Comments

Loading comments...