by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is coherent with its purpose and doesn't request secrets or network access. Before installing, consider: (1) it will persistently write to your agent workspace (MEMORY.md, atr-state.json, atr-log.jsonl) and append an entry to AGENTS.md (or inject a bootstrap virtual file) — review those files after installation; (2) the behavioral constraints (main-session only, not in group chats) are expressed in prompts rather than enforced by system-level checks, so review the hook/code and test i...详细分析 ▾
✓ 用途与能力
Name/description (capture reusable user preferences) matches the actual behavior: the SKILL.md and test scenarios describe detecting preference gaps and writing persistent records to workspace files (MEMORY.md, atr-state.json, atr-log.jsonl). The included hook simply injects the same prompt at bootstrap time. No unrelated credentials, binaries, or external services are requested.
ℹ 指令范围
Instructions tell the agent to read/write files under the agent workspace and to append an ATR entry to AGENTS.md. This is coherent for a memory-capture skill, but important to note: the policy constraints (e.g., only trigger in main-session, not group chats) are implemented as prompt text rather than enforced by sandboxing or runtime checks. The agent will autonomously interpret user replies and may persist memory entries; that behavior is expected but can lead to unexpected persistent writes if misclassified.
✓ 安装机制
No install spec and no downloads; the skill is instruction-first. The only code file is a small hook (handler.js) that appends a virtual bootstrap file to event.context.bootstrapFiles during agent:bootstrap. No networked installs or third-party package pulls are present.
✓ 凭证需求
The skill requires no environment variables, credentials, or external config paths. All state stays in local workspace files; the requested permissions are proportionate to the stated purpose.
ℹ 持久化与权限
The skill persists state and logs into workspace files and will append a section to AGENTS.md (or inject a virtual bootstrap file via the hook). Writing into AGENTS.md and creating MEMORY.md/atr-state.json is within the skill's purpose, but is persistent and can change agent startup docs/behavior — review that you are comfortable with those permanent workspace modifications.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.52026/3/19
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install preference-guide
镜像加速npx clawhub@latest install preference-guide --registry https://cn.longxiaskill.com