Li Python Sec Check

Python 安全规范检查工具 - 基于 CloudBase 规范 + 腾讯安全指南 + LLM 智能分析（LLM 功能默认禁用，本地执行优先）

This skill is coherent with its purpose, but follow these precautions before use: 1) Do not enable --llm when scanning sensitive or private code unless you trust and control the configured API endpoint. 2) If you must use LLM analysis in an enterprise, set LLM_API_BASE to an internal/private LLM and provide a dedicated key. 3) Inspect scripts/python_sec_check.py and scripts/llm_analyzer.py to confirm LLM calls are only made when the CLI flag is used (and that no API key is picked up silently from environment). 4) Run scans in an isolated environment (container/VM) when first evaluating the tool, and ensure no accidental LLM_API_KEY is present in CI environment variables. 5) If you allow autonomous agents to invoke skills, be cautious about enabling the LLM feature because it will transmit code snippets to the configured endpoint.

Type: OpenClaw Skill Name: li-python-sec-check Version: 0.0.2 The bundle is a legitimate Python static analysis tool designed to scan projects for security vulnerabilities and compliance issues based on CloudBase and Tencent standards. The core logic in `scripts/python_sec_check.py` uses regex-based patterns to detect risks like SQL injection, command injection, and hardcoded secrets, while `scripts/llm_analyzer.py` provides an optional feature to send code snippets to an external LLM API (defaulting to Alibaba DashScope at https://dashscope.aliyuncs.com) for remediation advice. This network behavior is transparently documented in `SECURITY_AND_PRIVACY.md`, is disabled by default, requires explicit user activation via the `--llm` flag, and triggers runtime warnings, indicating no malicious intent or stealthy data exfiltration.