Method Dev Agent

AI助手助力药品分析实验室高效管理色谱方法开发，支持实验记录、方法库、数据分析及AI优化建议。

What to check before installing or running this skill: - Inspect SKILL.md and README for hidden characters (unicode control chars). Use a hex viewer or an editor that shows non-printable characters; remove or ask the author about any strange contents. - Confirm which 'AI' features are local rule-based vs. remote LLM calls. The repository's code implements a simple rule engine (utils.suggest_optimization); if you expect external LLM functionality, ask the author whether an API key is required and whether network calls are made. - Do NOT run publish.sh unless you intend to push commits and publish to ClawHub. That script will attempt git commits, git push and clawhub publish and will use your git/clawhub credentials and network access. - Run the code in an isolated environment (virtualenv/container) and review requirements.txt. Start the Streamlit app locally and confirm it only reads/writes to the project data/ directory. - If you will store sensitive or regulated lab data, verify data storage and backup policies and consider encrypting or using an approved LIMS. This tool writes a local SQLite DB and CSV exports by default—ensure that matches your compliance needs. - If you want higher confidence, run the unit tests (tests/test_basic.py) and scan the code for any unexpected network/socket usage. The included code does not show outbound network calls, but thorough vetting is recommended. If you'd like, I can (a) produce a small checklist of exact commands to safely inspect files for non-printable characters, (b) summarize which files perform filesystem or network operations, or (c) generate a short list of questions to ask the author about the advertised 'AI recommendation' paid feature.

Type: OpenClaw Skill Name: method-dev-agent Version: 0.1.2 The skill contains a Local File Write (LFW) vulnerability in `src/utils.py::export_to_csv`. The `filename` parameter is used directly in `os.path.join` without sanitization, allowing for path traversal (e.g., `../../../../tmp/malicious.csv`). This could enable an attacker to write arbitrary files to arbitrary locations on the system where the process has write permissions, potentially leading to Remote Code Execution (RCE) if combined with other vulnerabilities. While this is a significant security flaw, it appears to be an unintentional vulnerability rather than clear evidence of malicious intent, classifying it as 'suspicious'.