by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: recommend vetted Go libraries and prefer the standard library when appropriate. Before installing or enabling it, note that the skill is allowed to run shell commands, read/write files, and fetch web pages — behavior that is reasonable if you want it to check maintenance, licenses, or to edit go.mod, but which could modify your repository automatically. If you plan to let the agent act autonomously, require review of any proposed code or dependency changes....详细分析 ▾
✓ 用途与能力
Name/description (recommend production-ready Go libraries) align with required resources: it only requires the 'go' binary and provides reference catalogs and guidance. Asking for 'go' is reasonable because the skill may check versions or module info.
ℹ 指令范围
SKILL.md is focused on recommending libraries and vetting maintenance/license/complexity. It does not instruct reading unrelated files or exfiltrating secrets. One minor content inconsistency exists across reference files: e.g., references/libraries.md calls lib/pq the 'gold standard' while evals.json contains tests that prefer pgx for many use cases; this is a documentation inconsistency rather than a security issue. The skill's allowed-tools include file write, bash (git), and web fetch/search — appropriate for checking maintenance and optionally editing go.mod, but these capabilities mean the agent could modify project files or fetch external pages at runtime, so review any automatic edits before accepting them.
✓ 安装机制
No install spec (instruction-only). Nothing is downloaded or written to disk by an installer, which is the lowest-risk install posture.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The absence of secrets is proportionate to a recommendation/cataloging skill.
✓ 持久化与权限
always is false and the skill does not request persistent system privileges. The skill allows autonomous invocation (disable-model-invocation is false) which is the platform default; combined with its limited scope this is acceptable.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.42026/3/23
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install golang-popular-libraries
镜像加速npx clawhub@latest install golang-popular-libraries --registry https://cn.longxiaskill.com