by 安全扫描
OpenClaw
可疑
high confidenceThe skill's code and instructions mostly match its stated purpose, but it fails to declare a required CLI dependency and will forward user queries to multiple agents by default, which could expose sensitive inputs — those inconsistencies warrant caution.
评估建议
This skill appears to do what it claims (parallelize queries to other agents) but has two practical concerns you should consider before installing:
1) Missing declared dependency: the included script calls the 'openclaw' CLI, but the skill metadata does not list that binary as required. Ensure you have the CLI available and understand what credentials it uses (it will likely use your agent/CLI credentials).
2) Data exposure: by default the tool forwards the user's original question to several ...详细分析 ▾
⚠ 用途与能力
The skill's purpose is to parallelize queries to specialized agents and synthesize results, and the implementation does that. However, the runtime script invokes the 'openclaw' CLI (spawn('openclaw', ...)) while the skill metadata lists no required binaries. Declaring the 'openclaw' binary (or equivalent) is expected and missing, which is an incoherence between claimed requirements and actual behavior.
ℹ 指令范围
SKILL.md and scripts/run.js stay within the stated scope: they read a JSON input, call configured agents in parallel using the OpenClaw CLI, then pass responses to a synthesizer agent. There is no attempt to read arbitrary files or env vars. Note: by default the tool forwards the user's query to multiple agents (default list includes strategist, data-analyst, finance, expert-coder, researcher, synthesizer). That behavior is expected for the stated purpose but may broaden who sees the user's data.
✓ 安装机制
There is no install spec (instruction-only with a provided script). No remote downloads or package installs are specified, so no high-risk install action is present. The script will be stored on disk as part of the skill, which is expected.
⚠ 凭证需求
The skill declares no environment variables or credentials, yet it relies on the local 'openclaw' CLI to invoke agents. That CLI will typically use system or agent credentials to make calls. The skill does not declare this dependency or the implicit access it will exercise. Additionally, the default behavior forwards queries to multiple agents which may have different privileges or data access — this broad sharing is not reflected in requires.env and should be explicitly called out.
✓ 持久化与权限
The skill is not always-enabled, does not request elevated persistence, and does not modify other skills or global agent config. It only executes at invocation, which is appropriate for its purpose.
⚠ scripts/run.js:35
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/27
local
● 无害
安装命令 点击复制
官方npx clawhub@latest install parallel-thinker
镜像加速npx clawhub@latest install parallel-thinker --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制