by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill is an instruction-only wrapper that installs and uses the public 'clawpolicy' package from PyPI. That is coherent, but installing any third-party package runs code at install time and then executes that package locally. Before installing: (1) review the upstream GitHub repo and PyPI package page for recent releases and maintainership, (2) run the included verify_install.sh in an isolated environment (virtualenv or VM) as the script itself does, (3) avoid giving the agent elevated cred...详细分析 ▾
✓ 用途与能力
Name, description, and SKILL.md all describe a CLI/Python API wrapper for the ClawPolicy project; required binaries (python3, pip3) and the pip install requirement are appropriate and proportional.
✓ 指令范围
Runtime instructions only install the PyPI package and call its CLI and Python module entrypoint; they create a local '.clawpolicy/' directory as documented. The SKILL.md does not ask the agent to read unrelated files, exfiltrate data, or access extra environment variables.
✓ 安装机制
Install is via PyPI (python -m pip install clawpolicy), which is expected for a Python CLI/library. No downloads from personal servers, shorteners, or arbitrary URLs are present. The included verification script uses an isolated venv, which is a good practice.
✓ 凭证需求
No environment variables, credentials, or config paths are requested. The package may write local files under the documented '.clawpolicy/' path, which is consistent with its purpose.
✓ 持久化与权限
The skill is not forced-always, does not request system-wide configuration changes, and contains no instructions to modify other skills. Autonomous invocation is allowed (platform default) and appropriate for a policy supervision tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv3.0.22026/3/10
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install clawpolicy
镜像加速npx clawhub@latest install clawpolicy --registry https://cn.longxiaskill.com