Model Advisor

模型推荐 + OpenClaw 安全系数分析工具。当用户询问"用哪个模型"、"推荐模型"、"适合什么模型"、"安全系数"、"openclaw 安全"、"根据历史"时触发。功能：(1) 根据历史会话自动分析任务类型并推荐最优的 Claude 模型（auto 模式），(2) 根据用户描述的任务推荐最优模型（recom...

This skill appears to do what it says — it analyzes your OpenClaw config and recent session messages to score security and recommend models. However, it reads private files in ~/.openclaw (session messages and openclaw.json), which may contain sensitive data (conversation content, API keys or auth config). Before running or installing: (1) review the full scripts/advisor.js to confirm there are no network calls or unexpected behavior (the visible portion shows none, but the file was truncated in the listing), (2) consider running it in a restricted environment or with a copy of your OpenClaw data if you want to avoid exposing real conversations, and (3) if you do not trust the skill author, do not execute the script as your main user — inspect it line-by-line or sandbox it. If you need, ask for a full listing of advisor.js to verify there are no outbound network requests or telemetry.

Type: OpenClaw Skill Name: model-advisor Version: 0.1.0 The skill performs broad read operations on sensitive local files, including the main OpenClaw configuration (openclaw.json) and the entire directory of session history logs (.jsonl), to calculate security scores and analyze user task patterns. While these capabilities are plausibly required for the stated purpose in SKILL.md and scripts/advisor.js, the access to private conversation history and gateway settings constitutes a high-risk behavior. The script does not contain evidence of data exfiltration or remote code execution, but it provides a mechanism for the agent to ingest and potentially expose sensitive historical data.