比较 dev/staging/prod 配置差异，并把技术差异翻译成业务风险。；use for env, config, diff workflows；do not use for 输出敏感密钥值, 直接覆盖配置.

This skill appears to do what it says: read local config files or directories and produce a human-reviewable diff/risk report. Before you run it or allow the agent to invoke it, consider: 1) Do not point the skill at your entire filesystem or at directories that contain production secrets (e.g., /, home, repository roots with credentials). The script will recursively read many file types. 2) The script attempts to mask 'secret-like' patterns but only truncates/masks parts of matched tokens (it may still reveal prefix characters), and other sensitive artifacts (URLs, filenames) may appear unmasked. Treat outputs as potentially sensitive. 3) Prefer running in an isolated or sanitized workspace (copy files with secrets redacted or run against sanitized copies). Use --dry-run first and review stdout rather than automatically writing or sharing outputs. 4) Review scripts/run.py yourself if you need higher assurance — it is self-contained and does not perform network calls, but it will read and include snippets from files you point it at. 5) The skill is not requesting credentials or network access; keep credentials out of the input and follow the SKILL.md guidance about not outputting secret values. If you need the skill to run autonomously, restrict its allowed input paths and audit its outputs for leaked data.

Type: OpenClaw Skill Name: env-diff-explainer Version: 1.0.0 The 'env-diff-explainer' skill is a legitimate utility designed to audit configuration differences across environments. The core logic in `scripts/run.py` includes a security-focused scanner that identifies high-risk patterns (such as 'curl|bash' or hardcoded secrets) and masks sensitive information before reporting. The skill's instructions in `SKILL.md` and `README.md` emphasize read-only operations, manual review, and risk mitigation, with no evidence of malicious intent, data exfiltration, or unauthorized execution.