流体网络求解与分析工具。输入TOML格式的网络描述，计算压力流量分布，分析负载状态和连通性。 Use when: 需要分析液压、环控、化工等流体网络系统的工况。 NOT for: 瞬态流动分析、可压缩流体。

This skill's functionality (TOML → solver → JSON) appears legitimate and the source code implements the described behavior, but there are a few red flags to consider before installing: - Incoherent packaging: SKILL.md claims 'instruction-only' but the bundle includes full source and an entire venv with vendored third-party packages. Ask the publisher why the virtualenv is bundled and whether the code has been audited. Consider requesting a minimal source-only release. - Inspect SKILL.md for hidden characters: the scanner found unicode control characters — open the SKILL.md in a hex-aware editor or run a small script to show non-printable characters. - Audit vendored dependencies: the venv contains many third-party packages; verify versions and signatures. Bundled dependencies increase risk of outdated or tampered packages. - Review CLI/file-reading behavior: the CLI can read arbitrary file paths. If you or an agent run the CLI with an attacker-controlled path, it could disclose local files. Only run in a controlled/sandboxed environment or ensure inputs are validated. - Run tests in an isolated environment: execute the included tests and a static scan (e.g., search for network calls, subprocess, eval, open with sensitive paths) before using on sensitive data. - Ask for provenance: there is no homepage and the source is 'unknown' — prefer packages with traceable source/repos or signed releases. If you want, I can (1) produce a short script to detect non-printable characters in SKILL.md, (2) produce a checklist of files to inspect in the venv, or (3) run a quick static scan of the repo for network I/O / subprocess / eval usage (reporting suspicious lines) if you provide the files.

Type: OpenClaw Skill Name: fluid-network-solver Version: 1.0.0 The 'fluid-network-solver' skill is a legitimate tool for analyzing fluid networks using TOML-based descriptions. The core logic in the 'src/' directory implements a linear solver and a connectivity analyzer using standard graph traversal and numerical methods. While the bundle is unusually large because it includes a full virtual environment ('venv') with the 'numpy', 'click', and 'colorama' libraries, the provided source code for these dependencies appears to be standard and untampered. No indicators of malicious intent, such as data exfiltration, shell execution, or prompt injection, were found in any of the files, including 'skill.py', 'src/cli.py', or 'SKILL.md'.