by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This package appears to be a lightweight incident triage playbook, but there are a few inconsistencies you should address before installing or using it: 1) Metadata mismatch — the package 'Name' field is '1.2.0' while SKILL.md identifies the skill as 'incident-triage-playbook'; ask the publisher for provenance or a proper homepage. 2) The runtime instructions call external CLI tools ('triage' and 'workflow') that are not provided or declared; ensure those tools exist in your agent environment or...详细分析 ▾
ℹ 用途与能力
SKILL.md, templates, and the described runbook-first triage workflow are consistent with the stated purpose. However the package metadata 'Name: 1.2.0' (instead of a human-readable skill name) and the healthcheck script printing 'pipiwu-benchmark-alpha-skill' are misaligned with the incident-triage identity and look like copy/paste or release metadata errors. Also the instructions assume the presence of 'triage' and 'workflow' CLI commands but the skill does not declare required binaries or provide those tools.
⚠ 指令范围
SKILL.md directs the agent to run CLI commands (triage, workflow) and to use local templates — the templates are included so that's fine — but there is no install spec or declared required binaries for those CLI tools. The instructions do not attempt to read unrelated system files or exfiltrate data, but they give the agent discretion to 'Save output artifacts for audit and handoff' which could lead to unspecified persistence unless the agent environment policies restrict it.
✓ 安装机制
This is instruction-only with no install spec. Included scripts are tiny and only echo strings. No downloads, no archives, and nothing is written to disk by an installer. From an install-mechanism point of view this is low risk.
ℹ 凭证需求
The skill requests no environment variables or credentials, which is proportionate. The only oddity is the healthcheck script printing a different skill name/version, which is inconsistent but not an immediate credential concern.
✓ 持久化与权限
always:false and user-invocable:true (defaults) — the skill is not force-included and does not request elevated platform privileges. It does not modify other skills or request persistence; templates and small scripts are self-contained.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.2.02026/3/7
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install incident-triage-playbook
镜像加速npx clawhub@latest install incident-triage-playbook --registry https://cn.longxiaskill.com