by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill is an instruction-only workflow that expects local scripts and apps on your Windows machine (WSL + python.exe + Doubao + audio player) and references absolute paths on the H: drive. Before installing or running: 1) verify the referenced workflow.py and any other scripts actually exist on the host and inspect their contents (the package does not include them); 2) confirm you trust the source—running this skill will execute local programs and control the GUI, which can read/write files ...详细分析 ▾
⚠ 用途与能力
Name/description match the workflow in SKILL.md, but the skill references a local script and absolute Windows paths (/mnt/h/...) and other skills (youtube-audio-download, doubao-launch, audio-play, doubao-capture) that are not included or declared. Required runtime pieces (WSL, python.exe, Doubao, visible Windows desktop) are implicit but not declared. The skill therefore assumes access to local resources beyond what's packaged.
⚠ 指令范围
Runtime instructions tell the agent to execute a Windows Python script via WSL and to perform GUI automation (Doubao) and read/write files on H: (e.g., H:/works/...). The skill explicitly relies on local filesystem and GUI automation; because no local scripts are provided, the agent would try to invoke files on the host filesystem, creating risk of executing unexpected code or reading unrelated files.
✓ 安装机制
No install spec and no bundled code files are included, which reduces remote install risk. However, absence of packaged code combined with references to an absolute local entry path means the skill depends on host-side artifacts rather than installing its own components.
ℹ 凭证需求
The skill requests no environment variables or credentials, which is consistent with a purely local GUI/file workflow. Still, it implicitly requires tools (WSL, python.exe, Doubao app, audio playback) and access to H: drive files; these environmental requirements are not declared and may grant broad filesystem and GUI access.
✓ 持久化与权限
always is false and there is no indication the skill requests persistent or elevated platform privileges. It does, however, expect to run local executables and GUI automation during invocation.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.42026/3/8
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install byt-workflow
镜像加速npx clawhub@latest install byt-workflow --registry https://cn.longxiaskill.com