by 安全扫描
OpenClaw
安全
medium confidenceNULL
评估建议
This skill appears coherent for orchestrating large code migrations, but it is high-level and relies on the agent/runtime to perform repository reads and to push branches/PRs. Before installing or invoking it: 1) Confirm which credentials the agent will use to access remotes (GitHub/GitLab tokens, SSH keys) and restrict their scope to only the needed repositories and actions. 2) Prefer a dry-run mode so you can review planned changes and generated PRs before merging. 3) Ensure CI/tests run on wo...详细分析 ▾
✓ 用途与能力
Name, description, and runtime instructions align: the skill describes splitting a large change into isolated units, validating each, and producing PRs/patches. It does not ask for unrelated resources or permissions.
ℹ 指令范围
The SKILL.md instructs the agent to inspect the repository, split work, launch parallel workers, and collect PRs/patches. This is expected for a migration orchestrator, but the instructions are high-level and open-ended: they do not specify how to authenticate to remotes, how to obtain or limit write access, nor do they include explicit safeguards about handling secrets that may appear in repo content. The agent running this will need to read repository files and may push branches/PRs using whatever VCS credentials are available.
✓ 安装机制
Instruction-only skill with no install steps and no code files, so nothing will be written to disk by the skill itself during installation.
ℹ 凭证需求
The skill declares no required environment variables or credentials, but its workflow implies needing VCS credentials (e.g., to push branches or create PRs) and access to the repository on disk. Because those credentials are not declared, you should verify which runtime credentials the agent will use and that they have appropriately limited scope (repo-level or machine-level Git credentials, tokens for GitHub/GitLab with minimal scopes).
✓ 持久化与权限
always is false and there is no indication the skill requests permanent or elevated platform-level privileges. It does not modify other skills or system-wide settings in the provided instructions.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/1
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install claude-code-batch-migration-orchestrator
镜像加速npx clawhub@latest install claude-code-batch-migration-orchestrator --registry https://cn.longxiaskill.com