Ai Company Cto — 实用工具
v"2.3.0"公司首席技术官技能包。覆盖全栈技术决策、MLOps生命周期、安全合规硬化、跨Agent接口协议、AI系统质量门。CTO-001 L4权限，与CISO/CQO/CFO/COO深度协同，遵循NIST AI RMF/ISO 27001/OWASP标准。
0· 88·0 当前·1 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's description (CTO / governance) is plausible, but the runtime instructions declare broad file, network and subagent permissions without concrete constraints — proportionate for orchestration but potentially risky and open-ended.
评估建议
This skill reads like a legitimate high-level CTO/governance playbook and is instruction-only (no installer or code). However, its metadata requests broad runtime permissions (read/write files, network/API access, and ability to spawn subagents). Before installing or enabling autonomous use: 1) Confirm you trust the skill owner/source (source: unknown). 2) Limit permissions: run in a sandbox or deny file/network/subagent permissions until reviewed. 3) If you must enable network or file access, r...详细分析 ▾
ℹ 用途与能力
Name/description (AI Company CTO — system architecture, governance, orchestration) align with an ability to read/write artifacts, call APIs, and coordinate agents. The skill declares dependencies on other internal company skills (ceo, ciso, hq, etc.), which fits a cross-functional CTO role. There are no required binaries or environment variables, which is consistent for a policy/architecture instruction-only skill.
ℹ 指令范围
SKILL.md is largely high-level governance, processes, templates and orchestration guidance — it does not embed shell commands, credentials exfiltration code, or references to unrelated system paths. However the instructions are broad and intended to drive operational changes (deploy, configure, govern AI agents). Because the skill is open-ended, an agent following it could legitimately be instructed to read/write files or call network APIs; the guidance contains no strict limits on what files/endpoints to touch.
✓ 安装机制
Instruction-only skill with no install spec and no code files. This is low-risk from an install perspective; nothing is downloaded or written by an installer step.
⚠ 凭证需求
The skill declares no required environment variables or credentials (good), but the embedded metadata requests permissions: files: [read, write], network: [api], and mcp: [sessions_send, subagents]. Those permissions are powerful and expand the agent's ability to access local files, call arbitrary APIs, and spawn/coordinate subagents. While these capabilities can be justified for a CTO/orchestrator role, they are broad and not scoped to specific paths, hosts, or services — increasing potential for misuse or accidental data exposure.
ℹ 持久化与权限
always:false (good). The skill allows normal autonomous invocation (disable-model-invocation:false), which is platform default. The notable privilege is the declared mcp capability to send sessions and spawn subagents — combined with autonomous invocation this increases blast radius if the skill is granted the declared permissions. There is no sign the skill modifies other skills' configs or requests permanent installation.
安全有层次，运行前请审查代码。
运行时依赖
OSLinux · macOS · Windows
安装命令
点击复制官方npx clawhub@latest install ai-company-cto
镜像加速npx clawhub@latest install ai-company-cto --registry https://cn.longxiaskill.com 镜像可用
本土化适配说明
Ai Company Cto — 实用工具 安装说明： 安装命令：["openclaw skills install ai-company-cto-2-0-0","npx clawhub@latest install ai-company-cto-2-0-0"]