Understand-Anything

Analyze a codebase to produce an interactive knowledge graph for understanding architecture, components, and relationships

This skill will read many project files, create temporary scripts in /tmp, and execute them (Node.js is assumed) while sending extracted file contents into dispatched subagents. Before installing: (1) Confirm the runtime has git and node (or request the author to declare required binaries). (2) Ask the author to fix the contradictory exclusion rules (the scanner claims to exclude *.json/*.md but then reads package.json and README.md). (3) Verify whether subagent prompts are sent to external model(s); if so, do not allow sensitive files (configs, env files, secrets) to be included — request an option to redact or exclude paths. (4) Prefer running this tool in a sandbox or on a copy of the repo with secrets removed. (5) If you only want limited analysis, use the documented --full/dir argument to scope to a safe subdirectory. (6) Inspect .understand-anything and /tmp outputs after a run and remove them if you don't want persistent artifacts. If you need help formulating questions for the skill author (required binaries, data exfil rules, ability to run offline), I can draft those.

Type: OpenClaw Skill Name: understand Version: 1.1.0 The 'understand' skill bundle implements a multi-phase codebase analysis pipeline that relies on generating and executing dynamic scripts (Node.js, Python, or Bash) to perform file discovery, structural analysis, and graph validation. While these capabilities are aligned with the stated purpose of architectural mapping, the pattern of writing and executing generated code from an AI agent represents a significant attack surface. Specifically, Phase 0 and Phase 1 ingest external project data (README.md and manifests) into subagent prompts, which could facilitate prompt-injection attacks if the analyzed codebase is malicious. No evidence of intentional data exfiltration or persistence was found in files like SKILL.md or the various prompt templates.