📦 Proposal Service — 技能工具
v1.0.0在public.openclaw_proposals中检视并新建真实OpenClaw提案，用于闭环流程查重与状态校验。
0· 225·1 当前·1 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's purpose (creating/checking proposals) matches the script's behavior, but the runtime requirements and privileges (docker exec into a DB container and performing SQL writes) are not declared and may be surprising or dangerous in many environments.
评估建议
This script will run 'docker exec' against a container named 'supabase-db' and execute SQL that can INSERT into public.openclaw_proposals. Before installing or running: 1) Confirm you run this in a trusted environment where 'supabase-db' is the intended database container and you expect proposals to be created in the live DB. 2) Ensure the agent or user running the skill has Docker privileges you are comfortable granting (docker exec allows container access). 3) Consider running it first in a st...详细分析 ▾
⚠ 用途与能力
The name/description match what the script does (read missions, check for duplicates, insert a proposal into public.openclaw_proposals). However the script implicitly requires ability to run 'docker exec' against a container named 'supabase-db' and run psql inside it; those runtime needs are not declared in the skill metadata (no required binaries or env vars). Requiring Docker access and container-level exec is a significant implicit dependency.
ℹ 指令范围
SKILL.md instructs running the included script to check or create a 'stale_missions_alert' proposal. The script only touches database tables in the public.openclaw_* schema (reads openclaw_trigger_rules and openclaw_missions; may INSERT into openclaw_proposals), which is consistent with the described purpose. It does not read arbitrary files, contact external endpoints, or exfiltrate data beyond the DB. Still, it performs writes to the real database and raises exceptions if certain conditions are met — this write capability is potentially impactful and should be expected by the user.
✓ 安装机制
This is an instruction-only skill with no install spec and a single shell script. No code is downloaded or installed by the skill package itself.
⚠ 凭证需求
The skill declares no required env vars or binaries, but the script hardcodes DB_CONTAINER='supabase-db' and uses 'docker exec' and psql inside the container. It therefore requires Docker access and the presence of a specific container name; that access is effectively a credential-like privilege (ability to exec into containers) but is not surfaced. AGENT_ID is hardcoded rather than provided as a configurable env var. The lack of declared runtime requirements and hardcoded identifiers is disproportionate to the metadata provided.
ℹ 持久化与权限
always:false (good). The skill can be invoked autonomously (default), which is normal, but because it performs DB writes when creating proposals, autonomous invocation increases potential impact. The skill does not attempt to modify other skills or system-wide configs.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/12
Initial release of proposal-service skill. - Allows inspection and creation of real OpenClaw proposals within the current closed-loop workflow. - Supports checking for duplicate pending proposals and creating new ones for the stale_missions_alert flow. - Uses only public.openclaw_* tables and the existing proposal logic from stale_missions_engine.sh. - Provides commands for checking for existing proposals and creating new stale-missions proposals.
● 无害
安装命令
点击复制官方npx clawhub@latest install proposal-service
镜像加速npx clawhub@latest install proposal-service --registry https://cn.longxiaskill.com
技能文档
Inspect and create real proposals for the current OpenClaw closed loop.
Commands
- Check whether the current stale-missions proposal already exists as pending
{baseDir}/scripts/proposal-service.sh check-stale-duplicate- Create the current stale-missions proposal
{baseDir}/scripts/proposal-service.sh create-stale-proposalNotes
- This skill uses the current real proposal pattern already implemented in the workspace.
- It works against
public.openclaw_proposals. - It is currently scoped to the
stale_missions_alertflow.