审计日志，操作记录 + 合规审计。

Do not clone or run the external repository until you verify its contents. This skill package contains no code and asks you to fetch and execute a GitHub repo—that could run arbitrary code or exfiltrate data. Steps to reduce risk before installing: 1) Ask the publisher for the repository owner, commit history, and a signed release or packaged code included in the skill bundle. 2) Manually inspect the GitHub repo (code, requirements.txt, app.py) for network calls, credential usage, or secret exfiltration before running. 3) Verify what environment variables and services (DB, object storage) the app needs and require them to be declared in the skill manifest. 4) If you must test it, run it in an isolated sandbox or container with no access to production credentials or sensitive data. 5) Prefer skills that include their code in the package or a reputable, well-audited release; avoid blindly executing 'git clone && pip install && python app.py'.

Type: OpenClaw Skill Name: ai-intelligent-audit-logging Version: 1.0.0 The skill bundle contains only metadata and documentation without providing the actual implementation code. The SKILL.md file instructs the agent to clone an external repository (github.com/openclaw-skills/ai-intelligent-audit-logging) and execute it locally via 'python app.py'. This pattern is suspicious as it encourages the execution of unvetted remote code, which could serve as a vector for supply chain attacks, although no specific malicious payload is present in the provided text.