by 安全扫描
OpenClaw
安全
medium confidence该技能表面上是一个本地 Python 基的死代码扫描器，没有请求无关的凭证或安装，但元数据省略和源代码列表被截断，防止了进行全面高信心审计。
评估建议
该技能看似合理：包含一个 Python 脚本，用于扫描本地项目以查找未使用的导出/文件/依赖，并提供 CLI 指令。安装或运行前，请确保：（1）环境中有 python3（元数据未声明此点），（2）审查完整脚本（包审查中提供的文件列表被截断——确认没有意外的网络调用、环境变量读取或写操作），（3）先在副本或样本仓库上运行工具以验证结果（基于正则表达式的扫描器可能产生假阳性），（4）避免授予其访问敏感仓库的权限或让其自主运行在所有项目上，除非您信任它。若欲获得更高的信心，请提供完整的未截断脚本进行审查或在沙盒环境中运行并检查任何网络活动。...详细分析 ▾
ℹ 用途与能力
SKILL.md and the included Python script both implement a JS/TS dead-code scanner, so purpose and capabilities align. Minor inconsistency: the runtime examples assume python3 is available, but the skill metadata does not declare any required binary; the skill may fail if python3 is absent.
✓ 指令范围
Runtime instructions only tell the agent to run the included script against a project path and to review results. The scanner reads project files (tsconfig.json, package.json) which is expected for this task. There are no instructions to read unrelated system files or to send data to external endpoints.
✓ 安装机制
No install spec (instruction-only) and the included script is pure Python with no declared external dependencies, so nothing arbitrary will be downloaded or executed during install. This is a low-risk install model.
✓ 凭证需求
The skill requests no environment variables, credentials, or config paths beyond reading project files (tsconfig.json, package.json) which are relevant to dead-code analysis. No evidence of unrelated secret access.
✓ 持久化与权限
always is false and the skill does not request system-wide changes or modify other skills. Autonomous invocation is allowed (platform default) but that is not excessive for a local code-analysis tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/11
Initial release
● 无害
安装命令 点击复制
官方npx clawhub@latest install dead-code-finder
镜像加速npx clawhub@latest install dead-code-finder --registry https://cn.clawhub-mirror.com
技能文档
简介
检测和清除 JavaScript/TypeScript 项目中的死代码。用法
- 确保环境中有 python3
- 运行脚本扫描项目
- 根据结果清除死代码
# 示例命令
python3 dead_code_finder.py /path/to/your/project
注意
- 先在副本或样本仓库上运行
- 审查脚本以确保安全
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制