AI 项目评估助手

描述一个项目想法，AI 从市场/技术/商业/风险四个维度系统评估， 输出评估报告、竞品速查、MVP建议，帮你决策「值不值得做」。

This skill runs a local Python script that sends your project text and a Bearer API key to an LLM HTTP endpoint (default: https://api.deepseek.com). Before installing or using it: (1) Inspect the code (you already have it) and confirm you trust the API_BASE domain. (2) Do not set your production OPENAI_API_KEY unless you intend that key to be sent to the configured API_BASE; prefer creating a dedicated key for this tool or set API_BASE to your trusted provider. (3) Update or ask the publisher to include the required env vars (OPENAI_API_KEY/DEEPSEEK_API_KEY) in the skill metadata so users are not surprised. (4) If unsure about the endpoint, run the script in a sandboxed environment or monitor outbound network calls. These mismatches (undocumented required creds and an unfamiliar default API host) are why this is rated 'suspicious' rather than 'benign.'

Type: OpenClaw Skill Name: project-evaluator Version: 1.0.0 The skill is designed to evaluate project ideas using an LLM, but it contains significant security vulnerabilities. The `SKILL.md` file provides an `exec` command template that is vulnerable to shell injection because it passes user-provided project descriptions directly into a shell command via the `--idea` flag. Additionally, `scripts/evaluate_project.py` allows writing output to arbitrary file paths provided by the user, which could lead to unauthorized file overwrites. While the logic appears intended for its stated purpose, these flaws represent a high risk of remote code execution and system compromise.