Spec Engine

项目规格自动生成与验证工具 — 从想法到任务清单的全流程自动化。 支持：(1) 智能生成 spec (2) 可配置验证评分 (3) 自动拆解子任务 (4) Web 仪表盘 (5) 版本对比 (6) 历史分析

What to consider before installing or running: - Inspect SKILL.md and the Python scripts locally (you already have them). Look specifically at analyze.py and daily_news.py: they walk directories and read .md files and have a default directory that may point to a shared/team path — don’t run them with defaults unless you want those directories scanned. - The collectors make outbound HTTP requests to public APIs and search engines; if you run these on a machine with sensitive network access, they will contact external servers. Run them in a sandboxed/container environment if you are unsure. - Remove or override default directory arguments (use --dir) to limit filesystem exposure. Prefer running with a dedicated test folder first. - Check for invisible/unicode-control characters in SKILL.md (the pre-scan flagged them) and remove them if present before using this skill with an LLM, since such characters can attempt to manipulate prompt parsing. - There are no declared secret/env requirements, but proxy env vars are used if present — review environment variables before running. - If you plan to let an agent invoke this skill autonomously, be cautious: the combination of filesystem scanning and outbound network calls increases the risk of unintended data leakage. Consider disabling autonomous invocation or restricting the skill to manual use until you’re comfortable with its behavior. If you want, I can: (a) list the exact lines where the default path and network calls occur, (b) show how to run the analyzer safely (example CLI flags), or (c) produce a sanitized version of SKILL.md with control characters removed.

Type: OpenClaw Skill Name: spec-engine Version: 3.0.0 The spec-engine bundle is a comprehensive toolset for project specification management, including automated generation, validation, task decomposition, and news aggregation. The Python scripts (e.g., generate.py, validate.py, and analyze.py) use standard libraries for regex-based text processing and file management. The collectors (bilibili.py, github_oc.py, etc.) perform outbound HTTP requests to public APIs and search engines to gather project-related news, which is consistent with the stated purpose of the daily_news.py script. No evidence of malicious intent, data exfiltration, or prompt injection was found.