📦 Deep Read — 深度读书助手
v1.0.0基于研究方法深度解析书籍，提炼核心观点、金句，生成可落地的应用指南与可关联的常青笔记，帮助用户快速吸收并运用书中智慧。
1· 106·0 当前·0 累计
by @zhubao315下载技能包
最后更新
2026/3/24
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it says (deep book analysis) and its code is a safe placeholder, but there are a few red flags to check before installing:
- The project lists openai and obsidian-api in requirements but does not declare any environment variables (e.g., OPENAI_API_KEY) or explain how Obsidian integration is configured. Ask the author or documentation how API keys or Obsidian credentials are expected to be provided.
- If you install dependencies, they will be fetched from PyPI; revi...详细分析 ▾
ℹ 用途与能力
Name/description match the code and SKILL.md: the skill analyzes books and emits insights/evergreen-note links. However, requirements.txt includes openai and obsidian-api even though the shipped code is a local placeholder and the skill does not declare or document required credentials or where Obsidian integration would connect. This is likely sloppy packaging rather than outright malicious, but it's an unexplained dependency.
✓ 指令范围
SKILL.md describes inputs (book_title, optional book_file, user_notes) and outputs and does not instruct reading unrelated files, environment variables, or external endpoints. The runtime instructions explicitly say OpenAI or other model calls are a placeholder and should be replaced in the hosting environment.
ℹ 安装机制
There is no install spec (instruction-only behavior) which is low-risk. But a requirements.txt lists third-party packages (openai, pandas, markdown, obsidian-api). Installing those packages would pull code from PyPI; obsidian-api and openai are notable because they may enable network calls. The repository does not provide an install script or pin trusted release sources.
⚠ 凭证需求
The code imports openai (and requirements list openai) but the skill does not declare any required environment variables (e.g., OPENAI_API_KEY). If the placeholder were replaced with actual API calls, an API key would be needed — this mismatch is unexplained. Similarly, obsidian-api suggests possible integration with a user's Obsidian vault or service, but no config variables or paths are declared. Requesting secrets or vault access without documenting why is a proportionality concern.
✓ 持久化与权限
Skill does not request always:true, requires no special config paths, and has no install script that modifies other skills or system-wide settings. It appears to be a normal, non-persistent skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/24
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install deep-read-analysis
镜像加速npx clawhub@latest install deep-read-analysis --registry https://cn.longxiaskill.com