by 安全扫描
OpenClaw
可疑
medium confidence代码与声明目的匹配（流式日志到 OpenClaw 聊天），但存在一致性和隐私问题：执行任意命令、写入状态/日志文件，并调用未声明的外部 'openclaw' CLI，可导致敏感日志数据注入聊天。
评估建议
["在运行前审查包含的脚本（您已经有源代码）。","脚本运行任意 shell 命令（--cmd）和尾随文件；仅指向您信任和控制的命令/日志。","调用 'openclaw' CLI 将消息注入聊天；确保了解 CLI 使用的凭据/配置，并信任目标聊天会话。","日志和 stdout/stderr 可能包含秘密（API 密钥、令牌、PII）；清除日志或限制尾随内容以避免意外泄露。","注意注册表元数据省略了对 'openclaw' 二进制文件的依赖；确保二进制路径和行为在您的环境中可接受。","更好地运行在隔离环境或使用最小特权；考虑使用显式 out-dir 在受控位置，并在使用后清除生成的文件。","如果需要更高的信心，请请求完整的未截断源代码，确认任何 CLI 依赖项，并先在安全沙盒中测试。"]...详细分析 ▾
⚠ 用途与能力
The skill's name and description match the code: it runs commands or tails logs and injects progress into chat. However the registry metadata declares no required binaries while the script spawns the external 'openclaw' CLI and uses '/bin/bash' to run arbitrary --cmd strings. The missing declared binary dependency (openclaw) is an incoherence the user should notice.
⚠ 指令范围
SKILL.md and the script instruct running arbitrary commands or tailing arbitrary files and periodically injecting parsed summaries/last log lines into a chat session. That scope is broad and can result in leaking sensitive contents from stdout/stderr or log files into the OpenClaw chat. The instructions give the agent broad discretion to run and monitor anything the user points at.
✓ 安装机制
No install spec is provided (instruction-only plus an included JS script), so nothing will be automatically downloaded or written by an installer. The script itself writes status/log files when executed, which is expected behavior for this utility.
⚠ 凭证需求
The skill declares no required environment variables or credentials, but it invokes the 'openclaw' CLI which will use the agent's existing OpenClaw credentials/configuration on disk; this is not declared. Additionally, because the tool transmits parsed log text and 'lastLine' to chat, secrets present in logs (API keys, tokens, paths, stack traces) could be exfiltrated to chat unintentionally.
✓ 持久化与权限
always is false and the skill does not request elevated platform privileges. It writes per-task status files under an output directory (default runs/task-progress-stream) but does not modify other skills or system-wide settings.
⚠ scripts/task_progress_stream.js:255
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/15
["task-progress-stream 初始发布。","实时流式传输长时间运行任务的进度到 OpenClaw 聊天 UI。","支持两种模式：运行（执行和监控命令）和尾随（监控现有日志文件）。","从日志中解析和总结常见训练指标（epoch、损失、ETA 等）。","适用于跟踪模型训练、评估、数据处理和其他长时间任务。"]
● 可疑
安装命令 点击复制
官方npx clawhub@latest install task-progress-stream
镜像加速npx clawhub@latest install task-progress-stream --registry https://cn.clawhub-mirror.com
技能文档
使用此技能当您想要在 OpenClaw 聊天 UI 中获得 长时间运行任务的实时进度更新，例如：
- 模型训练
- 评估
- 推理
- 数据预处理
- 长 shell 任务
- 基准测试运行
它工作在两种模式：
- 运行 启动命令，捕获 stdout/stderr，解析常见指标，周期性地将进度摘要注入聊天。
- 尾随 监控现有日志文件，周期性地将解析的进度摘要注入聊天。
它提取什么
尝试从日志中识别常见字段：- epoch / max_epoch
- step / max_step
- 损失
- 学习率
- 验证指标
- 最佳指标
- ETA
- 速度
典型用法
启动训练作业并将进度流式传输到聊天
node ./scripts/task_progress_stream.js run \
--session main \
--label train \
--cwd /path/to/project \
--cmd "python src/train.py --config configs/train.yaml" \
--interval-sec 20
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制