Security checks across malware telemetry and agentic risk
This skill has a legitimate table-analysis purpose, but it handles sensitive business table data with unsafe shell command construction and contradictory privacy claims about local-only processing.
Install only after reviewing or fixing the shell command construction. Use a least-privilege DingTalk token, prefer keyword-scoped runs, avoid full scans on sensitive workspaces, and use --no-llm unless you are comfortable sending sampled table contents to the configured OpenClaw model or agent context. Treat generated reports, logs, and cache metadata as sensitive because they may aggregate information from multiple business tables.
f'limit={page_limit} > "{tmp_file}" 2>&1')
# 执行命令
subprocess.run(cmd, shell=True, timeout=30)
# 读取并解析 JSON
with open(tmp_file, 'r', encoding='utf-8') as f:try:
# 执行命令，输出重定向到临时文件
cmd_redirect = f'{cmd} > "{tmp_file}" 2>&1'
result = subprocess.run(cmd_redirect, shell=True, timeout=30)
# 读取文件内容
with open(tmp_file, 'r', encoding='utf-8') as f:f'limit={page_limit} > "{tmp_file}" 2>&1')
# 执行命令
subprocess.run(cmd, shell=True, timeout=30)
# 读取并解析 JSON
with open(tmp_file, 'r', encoding='utf-8') as f:try:
# 执行命令，输出重定向到临时文件
cmd_redirect = f'{cmd} > "{tmp_file}" 2>&1'
result = subprocess.run(cmd_redirect, shell=True, timeout=30)
# 读取文件内容
with open(tmp_file, 'r', encoding='utf-8') as f:66/66 vendors flagged this skill as clean.