UniSkill V4
v4.1.0极简AI Agent框架 - 3%解决方案。从8771行精简到1000行,保留苏格拉底探明+多模型辩论核心方法论。
⭐ 0· 48·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (minimalist Socratic engine + multi-model debate) matches the provided code: socratic_engine_v4, idea_debater_v4, orchestrator_v4 and gateway implement the stated functionality. There are no unrelated required env vars, binaries, or surprising dependencies declared.
Instruction Scope
SKILL.md and gateway code describe keyword-based automatic triggering and provide a main entry (process_with_uniskill_v4). The runtime instructions and code do not read secrets or system configuration beyond inserting a package path and importing local modules. INTEGRATION.md and the gateway refer to a specific OpenClaw workspace path (~/.openclaw/workspace/skills/universal-skill/core_v4) — this is an integration hint (path insertion), not an explicit request for unrelated files, but it is something to be aware of. Comments/TODOs mention future integration with sessions_spawn / local or cloud models (i.e., external model calls are planned but not implemented).
Install Mechanism
There is no install spec in the registry metadata (instruction-only skill) and no remote download URLs. The package contains source files only. No high-risk download/extract steps are present in the manifest.
Credentials
The skill declares no required environment variables or credentials. The code uses model identifiers as role names (glm-5, qwen3.5-plus, kimi-k2.5) but the implementation currently uses heuristic/local scoring and contains TODOs where real model invocation could be added. No unexpected credential or secret names are requested.
Persistence & Privilege
always:false (normal). The skill is designed to be triggerable automatically by keyword matches (gateway.should_trigger) — this behavior can cause the agent to run the skill for matching user inputs without an explicit manual invocation. Autonomous invocation is the platform default; consider whether automatic keyword triggers are acceptable in your environment.
Assessment
What to check before installing
- Source/trust: the skill's origin/homepage is unknown; prefer installing from a verified GitHub/PyPI source and confirm repository contents match.
- Automatic triggering: the gateway auto-triggers on many keywords (CNC, decision words). If you don't want automatic runs, disable autonomous invocation or review agent trigger rules.
- Future network/model calls: model-calling code is currently stubbed/heuristic with TODOs mentioning sessions_spawn and cloud/local models. If later versions add remote model calls, they may require credentials — only allow that from trusted sources.
- Runtime dependencies: orchestrator imports psutil at runtime but requirements.txt does not include it; running in your environment may raise ImportError. Install and test in a sandbox or virtualenv and run the included tests (pytest) before enabling in production.
- Path insertion: INTEGRATION.md and the gateway manipulate sys.path and reference an OpenClaw workspace location — ensure this won't inadvertently cause module shadowing or import of unexpected code in your environment.
- Review logs and metadata: provided logs and scripts (github-release.sh) include author emails and repo URLs; verify these links before trusting published packages.
Recommended actions: run the package in an isolated environment, run the provided tests, inspect the code for any later commits that add external network calls or credential usage, and only enable automatic invocation if you understand and accept the trigger rules.Like a lobster shell, security has layers — review code before you run it.
latestvk97d3kchejzh44hx0w1e0dvtqs83v40j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
