by 安全扫描
OpenClaw
安全
high confidenceThe skill is internally consistent with its math-calculation purpose: it is an instruction-only skill that ships a local Python script for symbolic/numeric math, requests no credentials, and does not perform network or privileged actions.
评估建议
This skill appears to do what it claims and has no network/credential access. Before using: (1) be aware that sympy.sympify parses string expressions—if you run untrusted input through it there are parser-related risks in some setups, so prefer to run the skill locally or in an isolated environment; (2) the fallback uses eval with a restricted namespace which mitigates typical eval risks, but avoid feeding untrusted payloads; (3) if you plan to enable full sympy support, ensure sympy is up-to-da...详细分析 ▾
✓ 用途与能力
Name/description match the included assets: SKILL.md documents running the bundled Python script and the script implements arithmetic, equation solving, differentiation, integration, and matrix determinant. There are no unrelated binaries, env vars, or config paths requested.
ℹ 指令范围
SKILL.md instructs the agent to run the local script with specific CLI flags (e.g., --expr, --solve). The script only reads its CLI arguments and does not access files, network, or other system state. One caution: the script uses sympy.sympify on user-provided strings (when sympy is available)—parsing arbitrary user input can carry parser-related risks in some environments. The fallback path uses eval but with __builtins__ disabled and a restricted math-only namespace, which reduces risk.
✓ 安装机制
No install spec — the skill is instruction-only plus a small local script. Nothing is downloaded or written to disk by an installer.
✓ 凭证需求
The skill requests no environment variables, no credentials, and no config paths. This is proportionate to a standalone math utility.
✓ 持久化与权限
always is false and the skill does not request persistent/system-wide changes. It does not modify other skills or agent settings.
⚠ scripts/math_calc.py:42
Dynamic code execution detected.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/28
sync update from internal platform
● 可疑
安装命令
点击复制官方npx clawhub@latest install sq-math
镜像加速npx clawhub@latest install sq-math --registry https://cn.longxiaskill.com