project-assistant

项目初始化与智能分析工具。当用户要求初始化新项目、分析项目结构、项目问答时使用。触发词：初始化项目、init、分析项目、项目问答。

Before installing or enabling this skill: 1) Inspect SKILL.md, scripts/feishu_doc_manager.py and scripts/analyzers/env_scanner.py to understand what data is read, logged, or transmitted. 2) Be cautious storing any API tokens or secrets: the skill stores config in config.json (cross-session) and supports Feishu tokens — only add tokens if you trust the code and destination. 3) If you plan to run it on sensitive repositories, run it in a sandbox or on a copy without secrets (or remove .env and credentials first). 4) Remove or review any unicode/control characters in SKILL.md (they could be a prompt-injection artifact). 5) If you need guarantees about data exfiltration, require explicit declarations of external endpoints and audit the network behavior of feishu_doc_manager before providing tokens. If you want me to, I can scan the specific files (feishu_doc_manager.py, env_scanner.py, qa_doc_manager.py) and summarize any external network calls, data serialization, or obvious secret-handling code.

Type: OpenClaw Skill Name: project-assistant Version: 1.0.0 The bundle is a highly capable project analysis tool that includes several high-risk 'dual-use' features. Specifically, 'scripts/analyzers/env_scanner.py' is designed to scan the entire project for sensitive secrets, including OpenAI API keys, AWS credentials, and private keys, while 'scripts/analyzers/ipc_analyzer.py' maps out system-level communication interfaces. While these are framed as developer aids, they facilitate the aggregation of sensitive data. Additionally, multiple parsers (e.g., 'manifest_parser.py' and 'maven_parser.py') utilize the 'xml.etree.ElementTree' library, which is inherently vulnerable to XML External Entity (XXE) attacks. No evidence of intentional data exfiltration was found, but the combination of secret harvesting and vulnerable parsing logic warrants a suspicious classification.