by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill may be useful, but exercise caution before enabling it system-wide. Actionable steps: 1) Verify the skill's source (author unknown) and prefer a trusted origin. 2) Inspect any referenced host scripts before running them (G:\clawbot\config\self-repair.ps1, autoload-configs.ps1) — open them and confirm they do only the expected checks/updates and do not send data to external endpoints. 3) Check files the skill will read (SOUL.md, AGENTS.md, MEMORY.md, skills-config.json) for sensitive i...详细分析 ▾
⚠ 用途与能力
The skill claims to be a knowledge/learning framework, which is reasonable. However its instructions reference absolute system paths (G:\clawbot\config\self-repair.ps1, autoload-configs.ps1) and files outside the skill directory (SOUL.md, AGENTS.md, MEMORY.md, skills-config.json). Those global, system-level accesses are not described in the high-level purpose and suggest the skill expects access to the host's configuration and other skills' state — a capability that is disproportionate to a simple templating/indexing feature.
⚠ 指令范围
SKILL.md explicitly instructs the agent to read many external files and run PowerShell scripts (e.g., run G:\clawbot\config\self-repair.ps1, load G:\clawbot\config\autoload-configs.ps1, read SOUL.md/AGENTS.md/MEMORY.md) and to run Python indexing scripts. Those actions allow reading arbitrary files and executing arbitrary code on the host, which is broader than the skill's stated purpose and creates risk (possible exposure of sensitive data or unwanted system changes).
ℹ 安装机制
This is an instruction-only skill (no install spec, no code files bundled that would be executed on install), which reduces installation risk. The _meta.json lists dependencies (powershell, python3, requests) but there is no automated installer or external downloads declared. Absence of an install step is lower risk, but the skill still instructs execution of host scripts.
⚠ 凭证需求
The skill declares no required environment variables or credentials, yet references integration points (feishu_api.py, mentions Feishu/Telegram/Email integrations) that normally require API keys/tokens. It also targets global config files (skills-config.json) and memory files which may contain secrets or other skills' credentials. The lack of declared credentials combined with expected external integrations and filesystem access is disproportionate and unclear.
⚠ 持久化与权限
always:false and normal autonomous invocation are set (no excessive platform privilege). However the skill instructs use of autoload scripts and a self-repair script located in a global config directory — behavior that can alter or rely on host-wide configuration. That raises persistence/privilege concerns if those scripts modify global state or other skills' registration (skills-config.json).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/4
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install keep-learning-agent
镜像加速npx clawhub@latest install keep-learning-agent --registry https://cn.longxiaskill.com