by 安全扫描
OpenClaw
安全
high confidenceThe skill's requested capabilities and instructions align with its description: it's an instruction-only helper for running repo-local build/test/lint/install commands with safety rules and requests no extra credentials or installs.
评估建议
This skill is internally consistent and lightweight, but it is instruction-only — its safety guarantees depend on the agent and host sandbox actually enforcing the rules. Before using: (1) Confirm the agent runtime enforces workspace isolation and cannot access files outside the repo or escalate privileges. (2) Be cautious when installing dependencies: package registries and package install scripts can execute arbitrary code (supply-chain risk). (3) Prefer invoking this skill with explicit, pinn...详细分析 ▾
✓ 用途与能力
The name/description (safe, repo-local exec for build/test/lint/install) matches the SKILL.md. The skill declares no binaries, env vars, or installs that would be unrelated to its stated purpose.
ℹ 指令范围
The SKILL.md explicitly forbids destructive/system-wide actions, limits commands to the project workspace, and instructs treating user inputs as untrusted. However, enforcement is entirely procedural (relies on the agent following rules) and contains some subjective phrasing (e.g., "when the task can be completed without risky system operations"). The doc also permits installing dependencies via the project's package manager, which necessarily involves network access to registries and running package scripts — an expected but real supply-chain risk that the instructions do not further constrain.
✓ 安装机制
No install spec and no code files — instruction-only skill. This is the lowest-risk install model because nothing is written to disk by the skill itself.
✓ 凭证需求
No environment variables, credentials, or config paths are requested; nothing appears disproportionate to the stated purpose.
✓ 持久化与权限
always is false. The included agents/openai.yaml sets allow_implicit_invocation: false, reducing risk of implicit/autonomous invocation. The skill does not request persistent system presence or modify other skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/4/6
initial release
● 无害
安装命令
点击复制官方npx clawhub@latest install shell-safe-exec
镜像加速npx clawhub@latest install shell-safe-exec --registry https://cn.longxiaskill.com