by 安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: it keeps local files with your profile, vocabulary, grammar tracking, session logs and transcripts and provides scripts to initialize and export that data. Before installing: (1) review and approve the scripts (they run locally and require bash + python3 — the skill forgot to declare python3 as a required binary); (2) be aware that conversation content will be transmitted to whatever LLM backend your OpenClaw agent is configured to use (so choose a private/...详细分析 ▾
ℹ 用途与能力
The skill's name/description (a persistent language tutor) matches what the files do: storing learner profiles, vocab, grammar, sessions, and driving conversational lessons. One minor mismatch: the package metadata lists no required binaries, but the scripts call python3 (and are shell scripts), so the skill implicitly requires Python 3 and a POSIX shell to function.
✓ 指令范围
SKILL.md and the examples instruct the agent to read and update local files in the skill's data/ directory and run post-session bookkeeping. The instructions do not direct the agent to read unrelated system files or external endpoints. The README/SECURITY notes clearly warn that conversation text will be sent to whatever LLM backend the OpenClaw agent is configured to use.
✓ 安装机制
There is no external install step or downloaded code; the skill is instruction + local scripts that the user places into their agent skills folder. No network downloads, no remote executables or obfuscated payloads are present in the included files.
ℹ 凭证需求
The skill declares no required environment variables or credentials and indeed the code does not attempt to read secrets. The only proportionality issue is that scripts require python3 (and assume bash) but the metadata did not declare this; otherwise there are no requests for unrelated credentials or system-wide config access.
✓ 持久化与权限
The skill stores persistent learner data under its own data/ directory and includes scripts to create and export that data. It does not request always:true and does not modify other skills or global agent config. The dashboard manifest expects a refresh command that may be invoked by a dashboard (which is expected behavior for local skill dashboards).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/30
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install normieclaw-language-tutor-pro
镜像加速npx clawhub@latest install normieclaw-language-tutor-pro --registry https://cn.longxiaskill.com镜像同步中