by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be an orchestration scaffold for local coding tools and will instruct the agent to read/write repos and to launch local CLIs and background processes. Before using it: 1) verify you trust the skill author and the host machine; 2) check whether the referenced PowerShell scripts (assets/scripts/*.ps1) actually exist — they are referenced heavily but are not included in the provided files; 3) back up any target repositories and run the skill in a sandbox or test repo first; 4)...详细分析 ▾
ℹ 用途与能力
The name/description align with the files: this is a local supervisor/orchestrator for local coding CLIs (codex, claude, opencode). However many runtime commands and examples reference assets/scripts/*.ps1 wrappers and process/session handling that are not present in the package. That mismatch (instructions expecting scripts that aren't included) is an incoherence — either the skill is an instruction-only scaffold that expects external scripts, or required runtime components are missing.
⚠ 指令范围
SKILL.md and the docs instruct the agent to create task directories, persist JSON task records, read repo paths, run local CLIs, launch background processes, poll PIDs and session ids, and run PowerShell scripts (e.g., assets/scripts/supervise-task.ps1). Those are legitimate for a local orchestrator but are broad privileges (filesystem and process control). The bigger concern: the instructions call out specific scripts that are not bundled, so following them could lead the agent to run arbitrary commands or fail in unexpected ways. The instructions also leave broad discretion to write to user repos (supervisor may edit metadata or, by exception, product code), so you should only use this on trusted machines and after validating the intended scripts.
✓ 安装机制
There is no install spec (instruction-only). That reduces risk because nothing is downloaded or written by an installer. However functionality depends on local CLIs and on scripts referenced in the docs (which are missing), so the package as provided is incomplete for automated use.
ℹ 凭证需求
The skill declares no required env vars or binaries. That is consistent with being an orchestration scaffold that uses whatever local CLIs are present. The docs do expect access to repo paths, filesystem write capability, and the ability to inspect processes/pids; those are proportional to the stated purpose but are sensitive. The docs mention credential-related failure classes, yet no specific credential names are requested — the supervisor may detect missing credentials but does not declare needing them up front.
ℹ 持久化与权限
always:false and no install are appropriate. The skill explicitly recommends persistent task files and background worker metadata on disk; that is expected for an orchestrator but means it will create and modify files in user directories. It does not request elevated platform privileges or system-wide changes in the metadata provided, but persistent filesystem writes and background process management increase the blast radius if misused.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.2.22026/3/8
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install local-coding-orchestrator
镜像加速npx clawhub@latest install local-coding-orchestrator --registry https://cn.longxiaskill.com