by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it claims (slice long images and produce PDF/ZIP/Word outputs). Before installing or running it: 1) Note that the source is 'unknown'—if you don't trust the author, review the two Python files locally. 2) The scripts will write files to your home directory by default (~/openclaw/workspace/temp/slice-task); change the output path if you prefer. 3) The SKILL.md recommends pip installs (Pillow, numpy, python-docx, reportlab); install these in a virtualenv to avoid syst...详细分析 ▾
✓ 用途与能力
Name/description, SKILL.md, and the two Python scripts all align: they analyze long images, compute slice positions, write slice JPGs, and generate PDF/Word/ZIP outputs. Declared dependencies (Pillow, numpy, python-docx, reportlab) are appropriate for image processing and document generation. No unrelated binaries, env vars, or credentials are requested.
ℹ 指令范围
Runtime instructions are limited to obtaining the source image (user upload, URL download via curl, or local path), running the included Python scripts, and producing local outputs. Scripts read the provided image and write results to disk (default: ~/openclaw/workspace/temp/slice-task). They do not contact external endpoints or read unrelated system files. Minor scope inconsistencies: SKILL.md suggests the skill directory is ~/.openclaw/skills/long-image-slicer while the script default workspace is ~/openclaw/workspace (missing dot) — this only affects where outputs are saved.
✓ 安装机制
There is no automatic install step; the skill is instruction-only with bundled scripts. Dependencies are listed as pip packages in SKILL.md; no downloads from unknown URLs or archive extraction steps are present in the package. Users will need to run pip install manually (or the agent may do so), which is expected for Python-based skills.
✓ 凭证需求
The skill requests no environment variables or credentials. It uses the current user's home directory (os.path.expanduser('~')) to construct a default workspace path; this is reasonable for storing outputs but is worth noting so users know where files will be written. No secret access or unrelated service credentials are requested.
✓ 持久化与权限
The skill does not request permanent/always-on presence and does not modify other skills or global agent settings. It writes files to a per-task directory in the user's home; that is normal for a file-processing tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/19
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install long-image-slicer
镜像加速npx clawhub@latest install long-image-slicer --registry https://cn.longxiaskill.com