Skill Discoverer

L0 入口层 - 技能发现与引导引擎。帮助用户发现合适的技能，基于任务类型推荐技能组合，提供技能使用引导和教程。

This skill appears internally consistent and low-risk, but you should still take basic precautions before installing: 1) Verify the publisher/source (homepage is missing and owner ID is opaque); 2) If the platform lets skills execute shell/exec tools, restrict those capabilities (the SKILL.md lists Bash/Exec even though the code doesn't use them); 3) Review the included source (src/index.js) yourself or run the bundled tests in a sandboxed environment (jest) before granting broader permissions; 4) Confirm contact/support channels and the ClawHub listing before paying for any license; 5) If you plan to allow the agent to invoke skills autonomously, consider limiting network or credential access—this skill doesn't need secrets, so avoid granting unrelated tokens or credentials.

Type: OpenClaw Skill Name: skill-discoverer-pro Version: 0.1.0 The skill bundle is classified as suspicious due to significant over-permissioning. While the core logic in 'src/index.js' is a benign keyword-based recommendation engine, the 'SKILL.md' file requests high-privilege tools ('Bash' and 'Exec') that are not utilized by the current code or justified by the stated v0.1.0 functionality. This discrepancy creates an unnecessary attack surface for prompt injection against the AI agent. No evidence of intentional malice, data exfiltration, or obfuscation was found in the code or the standard Jest-based 'package-lock.json'.