by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements, install method, and runtime instructions align with its stated purpose (running qgis_process for local GIS workflows); nothing requested appears disproportionate or unrelated.
评估建议
This skill appears coherent and focused on running QGIS CLI workflows against local files. Before installing/using it: (1) ensure you want qgis installed via Homebrew (QGIS is large and may pull many dependencies), (2) confirm qgis_process is available on the target machine (the skill will fail otherwise), (3) note the SKILL.md examples use 'rg' (ripgrep) — install it or replace with grep, (4) be careful about file overwrites and review any proposed batch operations or autonomous runs (the skill...详细分析 ▾
✓ 用途与能力
The skill name and description match the declared requirement for the qgis_process binary and the brew install for the qgis formula. There are no unrelated environment variables, credentials, or config paths requested. Minor mismatch: SKILL.md examples use the 'rg' (ripgrep) command for filtering output but 'rg' is not declared as a required binary.
ℹ 指令范围
SKILL.md confines actions to local, file-based QGIS processing (list algorithms, inspect help, run algorithms, verify outputs) and includes safety checks (confirm CRS, avoid overwriting by default, dry-run policy). It does rely on executing shell commands against user files (expected for this skill). No instructions reference external endpoints or unrelated system credentials. One practical omission: example pipeline uses 'rg' which may not exist on the host — use grep or add rg to requirements if needed.
✓ 安装机制
Install spec uses Homebrew formula 'qgis' to provide qgis_process, which is a standard installation path on macOS/Homebrew-enabled systems. Note: QGIS is a large project with many dependencies and may require additional system packages or user approval during install; however this is expected for the stated functionality and not suspicious.
✓ 凭证需求
The skill requests no environment variables, credentials, or config paths — appropriate for a local-file processing tool and proportionate to its purpose.
✓ 持久化与权限
always is false and the skill is user-invocable. agents/openai.yaml sets allow_implicit_invocation: true (allowing implicit invocation) which is a normal platform default; this alone is not a red flag and is not combined with broad credential access or system modifications.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/14
- Initial release supporting QGIS geospatial processing via qgis_process for CLI-based GIS workflows. - Automates common vector and raster tasks: reprojection, clipping, dissolving, buffering, merging, and raster warping. - Enforces safe, repeatable processing: confirms input/output paths, output formats, CRS settings, and avoids source overwrites. - Includes best practices for workflow inspection, dry-run planning, and algorithm parameter discovery. - Designed for both English and Chinese GIS automation requests.
● 无害
安装命令
点击复制官方npx clawhub@latest install qgis
镜像加速npx clawhub@latest install qgis --registry https://cn.longxiaskill.com