安全扫描
OpenClaw
可疑
medium confidence该技能的描述、所需二进制文件(Rscript、bash)以及JSON驱动工作流对于基于R的统计工具来说是一致的。但是,它包含了shell脚本,代理被指示运行这些脚本,而其运行时行为(网络调用、任意shell命令、在output_dir外写入)没有显示——因此,在信任该技能处理敏感数据或授予自主执行权限之前,需要进行审查。
评估建议
此技能对于基于R的统计工作流内部是一致的,但它依赖于执行包含的shell/R脚本。安装或在真实/敏感数据集上运行之前:1) 检查脚本/run-rstats.sh和所有install-*.R脚本以及其他脚本,查找网络调用(curl/wget/git/R devtools::install_github)、数据外泄(HTTP POST、不寻常的端点)或访问output_dir外文件的命令。2) 验证R包安装来自CRAN/Bioconductor或受信任的GitHub仓库(无URL缩短器或个人服务器)。3) 首先在隔离环境(容器或沙盒)中使用非敏感示例数据运行该技能。4) 如果您希望允许自主调用,请仅提供非敏感访问权限或要求手动批准运行脚本。如果您愿意,请提供脚本/run-rstats.sh和任何install-*.R文件的内容,我将审查它们以查找不安全的操作。...详细分析 ▾
✓ 用途与能力
Name/description (82 R methods) match the declared requirements: Rscript and bash are reasonable and sufficient for driving R analyses and package installs. The referenced R packages and method table in the repo are consistent with the stated capabilities.
ℹ 指令范围
SKILL.md gives a bounded workflow: confirm dataset, run a local schema script, build a JSON spec, run analyze, and read output files. Those steps are within scope for a stats skill. However the runtime flow depends on executing scripts (scripts/run-rstats.sh and many install-*.R files). The provided SKILL.md listing shows many example data/spec files but the script contents were not fully visible here. Any shell script executed by the agent can perform arbitrary actions (network I/O, exec other commands, read arbitrary files) so their exact behavior should be inspected before use.
ℹ 安装机制
No platform install spec (instruction-only) reduces supply-chain risk. The skill likely installs R packages via included install-*.R scripts as needed; this is expected for R-based tooling. Still, package installation is networked (CRAN/bioconductor/GitHub) and the install scripts should be checked for unusual download URLs, URL shorteners, or external servers.
✓ 凭证需求
The skill declares no required environment variables, no primary credential, and no config path access. That is proportional: statistical analyses typically do not require secrets. There is no evidence the SKILL.md asks for unrelated credentials or reads environment variables beyond the declared binaries.
✓ 持久化与权限
always:false and no claims to modify other skills or global agent configuration. The skill will run autonomously by default (normal for skills), but it does not request permanent platform-level privileges.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/27
无用户面向的变化。仅版本更新。
● 可疑
安装命令 点击复制
官方npx clawhub@latest install r-stats
镜像加速npx clawhub@latest install r-stats --registry https://cn.clawhub-mirror.com
技能文档
何时使用
用户请求任何统计分析、假设测试、组比较、预测、关联分析、生存分析、元分析、因果推断、功效/样本大小分析或提及R统计包时。该技能不做的事情
- 声称观察数据的因果关系(使用“与...相关”)
- 运行大规模的探索性“钓鱼”式分析而没有明确的用户意图
...(由于字符限制,以下内容为部分示例,完整内容请根据原文自行翻译)
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制