by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be a reasonable blueprint for splitting and running large code migrations, but it assumes the agent can read and modify the repository and create PRs/patches without documenting required tools or credentials. Before using it: (1) verify what repository access the agent will actually have (read-only vs write/push), (2) avoid granting broad credentials — use a scoped token or run on a fork/CI runner with limited rights, (3) prefer a dry-run mode where the skill only produces ...详细分析 ▾
ℹ 用途与能力
The name/description align with the SKILL.md: it plans and parallelizes large codebase migrations. However, the workflow explicitly references inspecting the repo, creating isolated branches/worktrees, launching workers, and producing PRs/patches — capabilities that typically require git and VCS credentials, yet the skill declares no required binaries or credentials.
ℹ 指令范围
Instructions are concrete and limited to decomposition, verification, and parallel execution. They instruct the agent to read the repository, split units, validate each unit, and collect PRs/patches. That is in-scope for a migration orchestrator, but the instructions implicitly require repository access and the ability to push/merge (or at least produce patches) which are not documented or constrained.
✓ 安装机制
Instruction-only skill with no install spec and no code files to execute. This minimizes installation risk — nothing will be downloaded or written by an install step.
⚠ 凭证需求
The skill may need git, network access to remotes, and tokens for creating pushes/PRs, but it declares no required environment variables or primary credential. That absence is a proportionality gap: orchestration that creates PRs normally requires credentials (SSH keys or API tokens); the skill neither requests nor documents those, so it's unclear what privileges the agent will use to perform write operations.
ℹ 持久化与权限
always:false (good). Model invocation is allowed (default), meaning the agent can run this skill autonomously; combined with the environment/credential gap, that raises the blast radius if the agent has repository write permissions. The skill does not request persistent installation or modify other skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/2
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install batch-migration-orchestrator
镜像加速npx clawhub@latest install batch-migration-orchestrator --registry https://cn.longxiaskill.com