by 安全扫描
OpenClaw
可疑
high confidenceThe skill's description (retail target tracking) roughly matches the code, but there are clear incoherences: it silently depends on a user-specific external module and home-directory data files without declaring those dependencies or any credentials, and the code contains signs of being brittle/unfinished.
评估建议
This skill is suspiciously under-documented: before installing, verify the missing pieces. Specifically: 1) Inspect the external api_client (get_copilot_data) that the code imports from /Users/yangguangwei/.openclaw/workspace-front-door — understand what network endpoints it calls and what credentials it needs. 2) Confirm you have (or are willing to supply) the local data files (~/.openclaw/workspace-store-ops-analyst/targets/*.json and cache user_stores_114.json) and that they don't contain sec...详细分析 ▾
⚠ 用途与能力
The skill claims to be a local retail target-tracking analyzer and reads local target/mapping files (which is reasonable). However, the code imports get_copilot_data from an absolute, user-specific path (/Users/yangguangwei/.openclaw/workspace-front-door) that is not declared anywhere in the manifest or SKILL.md. That external dependency and implied API calls are not documented in the skill metadata (no required env vars, no install spec), so the runtime capability is under-specified and unexpectedly reliant on a local/remote service.
⚠ 指令范围
SKILL.md instructs reading files under ~/.openclaw and running analyze/check_alerts functions — expected for this purpose. But instructions do not mention the api_client dependency or network calls (fetch_actual_data calls get_copilot_data with '/api/v1/store/overview/bi'), so the true I/O surface (network/API access via an external client) is not disclosed. The SKILL.md also suggests cron usage but doesn't explain notification integration or required credentials.
⚠ 安装机制
There is no install spec, yet the package contains Python code that imports modules expected to exist in a specific user workspace. That implicit dependency on an out-of-repo module (via sys.path insertion of an absolute path) is fragile and risky: it will fail or behave unpredictably unless that external code and environment are present. No package sources or vetted release hosts are provided.
⚠ 凭证需求
Manifest declares no required env vars or credentials, but the code calls get_copilot_data (an API client not in the bundle). That client likely performs network requests and may need credentials or tokens stored elsewhere; those are not declared. The skill also reads user home data files (~/.openclaw/...), which may contain sensitive organization-specific data — this access is proportional to the stated purpose but should be documented and made explicit.
✓ 持久化与权限
The skill is not marked always:true and does not request any platform-level privileges. It suggests a user cron schedule example, but that is an optional usage pattern invoked by the user. There is no evidence the skill modifies other skills or system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/26
Initial release: 支持日/周/月三周期目标追踪、T-N数据延迟、黄绿黄灯预警
● 可疑
安装命令 点击复制
官方npx clawhub@latest install retail-target-tracking-analysis
镜像加速npx clawhub@latest install retail-target-tracking-analysis --registry https://cn.clawhub-mirror.com
技能文档
技能名称
target-tracking-analysis版本
v3.0功能描述
门店目标追踪分析工具，支持日/周/月三周期目标追踪，T-N数据延迟，黄绿黄灯状态预警。核心能力
1. 三周期追踪支持
- 日追踪 (
daily) - 晨会、实时预警 - 周追踪 (
weekly) - 周会复盘 - 月追踪 (
monthly) - 月度考核
2. T-N数据延迟支持
# T-1数据（默认）
analyze(store_id, store_code, period="daily", current_date="2026-03-25")# 定时任务检查
check_alerts(store_id, store_code, period="daily", t_minus=1)
3. 黄绿黄灯状态
| 达成率 | 图标 | 状态 | 告警级别 |
|---|---|---|---|
| ≥100% | 🟢 | 正常 | normal |
| 95-100% | 🟡 | 关注 | watch |
| 85-95% | 🟠 | 警告 | warning |
| 70-85% | 🔴 | 告警 | alert |
| <70% | 🔴 | 紧急 | critical |
4. 批量告警检查
from analyze import check_alerts_batch# 检查所有门店
alerts = check_alerts_batch(period="daily", t_minus=1)
# 返回按优先级排序的告警列表
使用示例
from analyze import analyze, format_report# 单门店分析
result = analyze(
store_id="1e7653_1750409683578",
store_code="420111020",
period="monthly",
current_date="2026-03-25"
)
print(format_report(result))
定时任务预留接口
# 每日9:00检查T-1数据
0 9 * python3 -c "
from target_tracking.analyze import check_alerts_batch
alerts = check_alerts_batch('daily', t_minus=1)
# 接入通知渠道
"
数据文件
- 每日目标:
~/.openclaw/workspace-store-ops-analyst/targets/daily_targets.json - 门店映射:
~/.openclaw/cache/user_stores_114.json
版本
v3.0.0 - 三周期追踪、T-N数据延迟、黄绿黄灯预警数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制