Synapse Code

Synapse Code — 智能代码开发工作流引擎。 一体化完成项目初始化、代码交付、知识沉淀和影响分析。 内建代码图谱引擎，越用越懂你的项目。 当用户提到开发、实现功能、运行 pipeline、记录知识、检查影响范围时使用此技能。

This skill appears consistent with its stated purpose (a multi-agent pipeline + knowledge tool). Before installing: 1) Inspect install.sh and package.json for network calls or npm postinstall scripts; 2) Verify the npm package 'gitnexus' origin and reputation (it will be installed into the skill and exposes a 'gitnexus' binary); 3) Run the install and first runs in an isolated environment (container or throwaway VM) if you want to avoid accidental writes to important projects; 4) Note the skill will create and write .synapse/.knowledge and pipeline artifacts (and may read project files under the supplied project path) — do not point it at sensitive repos unless you trust it; 5) If you plan to enable cross-service integrations (Telegram/Feishu/remote scraping), only provide API keys after reviewing where they are stored and sent. If you want extra assurance, share the install.sh and package.json for a targeted review.

Type: OpenClaw Skill Name: synapse-code Version: 2.0.1 The skill bundle implements a highly complex multi-agent development framework with significant system privileges, including shell command execution and file system manipulation. While no explicit evidence of intentional malice (such as data exfiltration or hardcoded backdoors) was found, the system's architecture relies heavily on executing unverified external scripts (e.g., pipeline.py and parallel_executor.py) located in the user's home directory (~/pipeline-workspace/). This creates a substantial risk for local code execution if the workspace is compromised. Furthermore, the install.sh script performs broad environment checks and installs third-party dependencies (gitnexus via npm), which increases the supply chain attack surface.