国际形势分析智能体

PassAudited by ClawScan on May 12, 2026.

Overview

This instruction-only analysis skill is coherent and broadly benign, but it relies on external search/upload helpers and optional recurring reports that users should enable knowingly.

This skill appears safe to use for geopolitical analysis. Before using Word export, download-link upload, or recurring update features, make sure the referenced helper skills are installed from trusted sources and avoid uploading confidential report content unless you trust the uploader service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Search and upload behavior depends on external helper skills whose code and destinations are not shown here.

Why it was flagged

The skill delegates search and upload behavior to scripts from other skills that are not included in the reviewed file set. This is disclosed and aligned with the report workflow, but users must trust those separate skills.

Skill content
python3 /root/.openclaw/workspace/skills/xfyun-search/scripts/search.py ...; python3 /root/.openclaw/workspace/skills/uploader/scripts/upload_media.py ...
Recommendation

Install or use this only with trusted xfyun-search and uploader skills, and review those skills separately if sensitive reports will be generated.

What this means

A generated report could be uploaded outside the local workspace when a download link is requested.

Why it was flagged

The skill may pass generated Word reports to an uploader helper to obtain a download link. The destination is not described in these artifacts, though the behavior is tied to user-requested report export.

Skill content
上传获取下载链接:
python3 /root/.openclaw/workspace/skills/uploader/scripts/upload_media.py '/path/to/report.docx'
Recommendation

Avoid including confidential information in generated reports unless you know and trust the uploader destination and access controls.

What this means

If recurring updates are configured elsewhere, the agent may produce ongoing reports beyond a single interaction.

Why it was flagged

The skill advertises recurring or event-triggered update services. No persistence mechanism or background worker is included, so this is a user-awareness note rather than evidence of hidden autonomous behavior.

Skill content
支持定时更新服务:周报、月报、事件触发
Recommendation

Enable weekly, monthly, or event-triggered reporting only with explicit user approval and a clear way to stop it.