by 安全扫描
OpenClaw
可疑
high confidenceThe skill's stated Excel-cleaning purpose is plausible, but the distributed code is incomplete (missing the actual excel-handler) and the module returns payment-and-success messages regardless of implementation — this inconsistency warrants caution before installing or paying.
评估建议
Do not install or pay for this skill yet. Key issues: (1) the core implementation (./excel-handler) is missing — the package cannot perform the Excel operations it advertises; (2) the code performs payment checks and will present a pay link — confirm the payUrl originates from the platform before paying; (3) SKILL.md intends to write a new file to your Desktop — ask for explicit details about where files will be saved and whether existing files may be overwritten; (4) request the missing excel-h...详细分析 ▾
⚠ 用途与能力
The SKILL.md describes straightforward Excel operations (remove blanks, dedupe, sort, save). The code's main logic delegates to require('./excel-handler'), but that file is not included in the package. This means the implementation required to perform the stated work is missing — the package as distributed cannot actually do what it claims.
⚠ 指令范围
SKILL.md asks the agent to let the user pick a file, read/modify it, and 'save new file to desktop' — which implies filesystem read/write of user files. The code returns a success message '新文件已保存至桌面' without showing any file operations (those would be in the missing excel-handler). Because the actual file-handling code is absent, it's unclear what would run and what data would be written or transmitted.
✓ 安装机制
There is no install spec and no external downloads; the skill is instruction/code-only. The only external require is '@clawhub/skill-sdk', which the code comments claim is provided by the platform. No third-party fetches or archive extraction are present in the repo.
ℹ 凭证需求
The skill declares no required environment variables and no config paths. The code uses a platform billing SDK (SkillPay) and assumes the platform injects the SkillPay API key; this is plausible for platform-hosted skills. There are no explicit requests for unrelated credentials, but the payment flow means users will be asked to complete a purchase via a generated payUrl — verify that URL comes from the platform.
✓ 持久化与权限
The skill does not request always:true, does not declare persistent system-wide modifications, and does not ask to change other skills' configs. It follows the platform default that allows autonomous invocation, which by itself is not a new concern.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/3/25
- Initial code file (index.js) added. - Documentation updated to reflect version 1.0.1.
● Pending
安装命令
点击复制官方npx clawhub@latest install excel-auto-clean
镜像加速npx clawhub@latest install excel-auto-clean --registry https://cn.longxiaskill.com