by 安全扫描
OpenClaw
安全
high confidenceInstruction-only scaffolding skill whose requests and instructions are consistent with its stated purpose; no credentials, installs, or hidden code are present — but double-check the referenced PowerShell scaffold script if you plan to execute it.
评估建议
This skill is instruction-only and appears coherent for bootstrapping documentation, configs, and readiness artifacts. Before running any recommended scripts: (1) confirm whether tools/new-presale-service.ps1 exists — the package you provided does not include it; (2) if the script is present, open and review its contents to ensure it does not perform network calls, credential access, or modify system-wide files; (3) run any untrusted script in an isolated environment (container or disposable VM)...详细分析 ▾
✓ 用途与能力
The skill's name and description describe scaffolding a presale service; the SKILL.md and the two reference docs strictly instruct creating docs, configs, plans, readiness checks, and repo structure. There are no unrelated environment variables, binaries, or install steps requested, so the declared purpose aligns with the actual requirements.
ℹ 指令范围
The runtime instructions stay within scaffolding/documentation generation scope (creating docs/, config/, plans, readiness checklist, etc.). They do, however, recommend running tools/new-presale-service.ps1 'from this skill pack' — but that file is not present in the package listing. If a scaffold script is later provided, inspect it before running because instruction-only skills rely on the agent executing commands you might not expect.
ℹ 安装机制
No install spec is present (lowest-risk form). Minor inconsistency: the SKILL.md recommends running a PowerShell script, but the skill does not declare any required binaries (e.g., PowerShell) nor include that script in the manifest. This is an implementation gap rather than an active install risk in the current package.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no config paths. That matches its stated purpose of local repo scaffolding and documentation creation; nothing appears disproportionate.
✓ 持久化与权限
always is false, and the skill is user-invocable only. There is no install or code that would persist or elevate privileges. Autonomous invocation is allowed by platform default but is not combined here with broad permissions or credentials.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/2/22
Initial reusable release
● 可疑
安装命令
点击复制官方npx clawhub@latest install presale-service-bootstrap
镜像加速npx clawhub@latest install presale-service-bootstrap --registry https://cn.longxiaskill.com镜像同步中
技能文档
Create the service foundation before any implementation.
Execute
- 创建 minimal repo structure:
docs/,配置/,src/,tests/,prompts/,scripts/. - Build canonical context docs 从 templates.
- Build 在 最少 one implementation plan 带有 gap-check, acceptance scenarios, verification matrix, 和 summary snapshots.
- Build one-pass launch docs 和 readiness checklist.
- Freeze non-goals 和 constraints 在...中 writing.
使用 deterministic scaffold tool 第一个
Runtools/new-presale-service.ps1 from this skill pack when possible.然后 fill definitions
Read and apply:references/workflow.mdreferences/artifacts.md
必填 quality gates
- 否 definitions -> 否 coding.
- 否 readiness checklist -> 否 one-pass launch.
- 否 verification matrix 模板 在...中 plans -> 否 implementation approval.