project-analyzer

SDD 软件设计文档生成器 - 基于 Harness Engineering 模式构建受控环境。 核心理念：通过架构约束、上下文工程、反馈循环、熵管理，让 AI 在约束下高效可靠地生成文档。 使用场景：(1) 新项目接入时生成 SDD 文档 (2) 生成开发规范 (3) 分析数据库结构 (4) 对接 Apifox...

This skill appears to be what it says (an automated SDD/project analyzer) but it deliberately reads the full contents of a project, including config files and deployment manifests that often contain secrets (DB passwords, API keys, kube secrets). Before installing or running: - Inspect the omitted files (especially agents/openai.yaml, scripts/main.py, and any other truncated modules) for network calls (search for 'requests', 'http', 'urllib', 'socket', 'openai', 'apifox', 'upload', 'POST') and any code that sends scanned data externally. - Confirm whether Apifox/OpenAI integrations exist and, if so, what credentials they need and where those credentials are stored; the skill does not declare required env vars but may still attempt external sync. - Do not run the tool directly on repositories that contain production secrets. Instead, run it on a sanitized copy or in an isolated VM/container. - If you need to grant it access to a project with sensitive data, remove or redact secrets (or mount a curated subset of files) and monitor network activity during the first run. Because several files were truncated in the provided bundle, I rate the assessment as medium-confidence — reviewing the omitted source (especially anything that references external endpoints or credentials) could move this to benign or reveal higher risk.

Type: OpenClaw Skill Name: project-analyzer Version: 1.0.6 The project-analyzer skill is a legitimate tool designed to automate the generation of software design documentation (SDD) by scanning local project files. It utilizes a suite of Python scripts (scripts/main.py, scripts/project_scanner.py, scripts/database_scanner.py, etc.) and specific AI agent instructions (SKILL.md) to identify technology stacks, database schemas, and API endpoints. While the skill requires broad read access to source code and configuration files (e.g., pom.xml, application.yml, and SQL scripts) to perform its analysis, its behavior is strictly aligned with its stated purpose. There is no evidence of data exfiltration, credential theft, unauthorized remote execution, or malicious prompt injection.