📦 nutcracker — 用户行为洞察
v1.0.0嵌入式的 UX 研究能力，全天候追踪用户与 OpenClaw 的交互，自动记录对话模式、任务完成率及摩擦点，为产品迭代提供量化依据。
0· 321·0 当前·0 累计
by 下载技能包
最后更新
2026/2/28
安全扫描
OpenClaw
可疑
medium confidenceThe skill's described purpose (embedded UX research) matches its instructions to observe and log conversation data locally, but it aggressively captures verbatim user content, provides weak safeguards around sensitive data identification, and leaves important privacy/handling details unspecified — so its behavior is coherent but risky and needs clarification before installation.
评估建议
This skill broadly logs conversation content and stores it under ~/.uxr-observer; before installing, confirm you understand and accept that behavior. Ask the publisher for specifics: how sensitive content is reliably detected and redacted, retention and deletion policy, whether logs are encrypted at rest, who (if anyone) can read ~/.uxr-observer on the host, and exactly which 'email/messaging tools' will be used when you request sharing. If you proceed, require explicit opt-in during first run, ...详细分析 ▾
✓ 用途与能力
Name and description (embedded UX research) align with instructions to observe conversations, run micro-surveys, and generate local reports. The requested actions (log interactions, prompt surveys, produce daily reports) are coherent for a UXR observer and there are no unrelated credentials or binaries required.
⚠ 指令范围
Instructions direct the agent to passively observe every interaction and aggressively capture verbatim quotes (with some exceptions). That scope is large but consistent with UXR. However the skill relies on the agent to detect and redact 'sensitive' content without specifying detection rules, edge cases, or error handling. It also instructs writing persistent logs to ~/.uxr-observer and to trigger on session start/end/each task; these behaviors affect user privacy and may capture secrets inadvertently. The policy that 'never transmits data externally' is qualified by allowing user-requested sharing via 'whatever email/messaging tools are available,' which is vague and could lead to unintended transmissions if the agent misunderstands a request.
✓ 安装机制
No install spec and no code files — this is instruction-only. That lowers risk from downloads or executing fetched binaries because nothing is written to disk by an installer, but the instructions themselves direct the agent to create local files, which is expected for a logging tool.
ℹ 凭证需求
The skill requests no environment variables or credentials (proportionate). One mismatch: it permits using existing email/messaging tools to share reports on user request but does not declare or require any credentials or explain which tools will be used — this ambiguity could result in the agent trying to access unrelated credentials or invoking external services without explicit, auditable steps.
ℹ 持久化与权限
always is false (good). The skill expects to run on session start/after tasks/end-of-day and the platform default allows autonomous invocation — that is consistent with its design. Because it will run continuously and log interactions, the combination of autonomous invocation + broad data capture increases the privacy blast radius; however this is a design property rather than an incoherence in the manifest.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/28
Initial release of uxr-observer: embedded, privacy-conscious UX research for OpenClaw. - Passively observes all user interactions to track intents, outcomes, friction, sentiment, and notable verbatim quotes. - Actively triggers brief micro-surveys after each completed task for direct user feedback. - Stores all data locally under `~/.uxr-observer/`; never transmits data unless explicitly requested by the user. - Provides daily insight reports the user can review and share if they choose. - Ensures sensitive content (passwords, API keys, personal secrets) is never logged verbatim. - User can opt out or pause observation at any time.
● 无害
安装命令
点击复制官方npx clawhub@latest install clawsight
镜像加速npx clawhub@latest install clawsight --registry https://cn.longxiaskill.com