Python包鸿蒙兼容性测试技能

Check Python library compatibility with HarmonyOS. Downloads source from GitHub/PyPI, detects Windows-specific dependencies, runs pytest with per-test-case r...

This skill does what it says (downloads package source, scans for Windows imports, runs tests and emits reports) but has two practical security concerns you should consider before installing or running it: 1) TLS bypass: The included script disables TLS certificate verification when downloading from GitHub/PyPI. That is unnecessary in normal environments and makes downloads susceptible to man-in-the-middle tampering. Ask the author to remove disabling of ssl verification (restore default SSL checks) or explain why it is required for your environment. 2) Execution of untrusted code: To assess compatibility the tool downloads packages and runs their test suites. Tests can execute arbitrary Python code (including network access, file operations, or deleting files). Only run this tool in an isolated sandbox (container, VM, or dedicated build runner) that has no access to secrets, credentials, or sensitive mounts. Prefer ephemeral environments; do not run on developer workstations or production hosts. Other points to verify: - Resolve the version mismatch between registry metadata (1.0.1) and manifest.json (1.2.0). - If you need safer operation, request changes: re-enable SSL verification, add optional allowlist of trusted repos/packages, add explicit safeguards (no-network mode, resource/time limits, capability drops), and document exactly which subprocesses (pip, pytest) are invoked. - Use --keep-source only for manual inspection in a safe place; retained sources may contain malicious code. If the author provides evidence that TLS is only disabled for a narrow, documented HarmonyOS reason or they add sandboxing/allowlisting, my assessment would move toward benign. Until then, treat this skill as potentially risky but not clearly malicious.

Type: OpenClaw Skill Name: python-harmony-compatibility-checker Version: 1.0.1 The skill bundle is classified as suspicious primarily due to the intentional disabling of SSL certificate verification (ssl.CERT_NONE) in scripts/check_compatibility.py when downloading package source code from GitHub and PyPI. While the tool's core functionality—downloading, installing, and executing third-party code via pip and pytest—is inherently high-risk, it is consistent with the stated purpose of a compatibility checker. However, the lack of transport security is a significant vulnerability that exposes the agent to Man-in-the-Middle (MITM) attacks during the download phase.