tvs-analyze

用户要求代码分析时，提供项目的结构、依赖关系、主要业务、存在问题等信息，帮助开发者快速了解项目。或用户问一些代码的作用时，寻找相关代码的业务逻辑相关代码，分析并总结其作用和实现细节。

This skill appears to do what it claims. Before running: (1) inspect scripts/generate-madge.mjs (already included) — it only runs 'command -v', npx madge, and checks Graphviz; (2) be aware that using npx may download and execute packages from npm at runtime — if you prefer, preinstall madge and graphviz to avoid network fetches; (3) avoid running the tool on directories containing sensitive secrets you don't want written into generated artifacts; (4) resolve the minor path inconsistency in SKILL.md (where to run the script) before use. If you need higher assurance, run the script in a sandboxed environment or review/replace 'npx' invocation with an explicitly installed madge binary.

Type: OpenClaw Skill Name: tvs-analyze Version: 1.0.0 The skill bundle provides project analysis capabilities but includes a Node.js script (`scripts/generate-madge.mjs`) that is vulnerable to command injection. The script uses `execSync` to execute shell commands (running `npx madge`) using unsanitized input from command-line arguments, which could be exploited to achieve Remote Code Execution (RCE) if the AI agent passes malicious user-provided paths to the script. While the functionality aligns with the stated purpose of code analysis, the lack of input sanitization in a shell-executing script represents a significant security risk.