by 安全扫描
OpenClaw
安全
high confidenceThe skill's files, runtime instructions, and required binaries align with its stated purpose of building ECharts artifacts; there are no unexplained credential requests or hidden endpoints, but you should note dependency and runtime implications (Playwright/browser, CDN loading).
评估建议
This skill appears to do what it says: build ECharts option JSON, preview pages, and image exports. Before installing or running it, note: (1) You need node (or bun) and the Node dependencies (the scripts import modules such as playwright-core) — there is no automatic installer included, so ensure dependencies are installed in a controlled environment. (2) The render-image flow uses Playwright to launch a local Chromium-based browser (it searches PATH and common install locations, and respects E...详细分析 ▾
✓ 用途与能力
Name/description match the included scripts and docs: the package contains build, lint, and render-image Node scripts to produce ECharts option JSON, standalone HTML preview pages, and PNG/SVG exports. The declared runtime requirement (node or bun) is appropriate.
ℹ 指令范围
SKILL.md explicitly instructs running the included node scripts (build, lint-option, render-image). The scripts read and write files under artifact directories and use a bootstrap JSON embedded in chart.html. render-image launches a headless browser via Playwright to render/export images and searches the filesystem and environment variables for a Chromium executable (uses PATH, ECHARTS_BROWSER_PATH, PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, CHROME_PATH). These actions are coherent with image-export functionality but mean the skill will access local files and local browser executables and may load ECharts from the CDN URL (network).
ℹ 安装机制
There is no install spec (instruction-only), which is low-risk, but the included scripts import third-party modules (notably playwright-core). That implies the runtime environment must already have required npm dependencies installed; otherwise image export will fail. No remote download or obscure URL is used by the install process itself.
✓ 凭证需求
The skill requests no credentials or config paths. It does read common environment variables (PATH, LOCALAPPDATA) and optional browser-path env vars (ECHARTS_BROWSER_PATH, PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, CHROME_PATH) to locate a browser for rendering images — this is proportionate for the render-image feature and not a secret-exfiltration pattern.
✓ 持久化与权限
always is false and the skill does not request persistent system privileges or modify other skills. It operates on files it is pointed at (artifact directories) and writes output there, which is normal for a builder/exporter tool.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/25
**Adds in-build export option for static images.** - You can now export PNG or SVG images directly during chart build with the `--export-image` flag. - Multiple export images (e.g., PNG & SVG) can be created in a single build run. - Documentation updated with examples for in-build image export and corresponding artifact changes. - `manifest.json` now records single or multi-format image exports for better artifact tracking.
● 无害
安装命令
点击复制官方npx clawhub@latest install echarts
镜像加速npx clawhub@latest install echarts --registry https://cn.longxiaskill.com