Package Version Tracker

查询 npm 和 PyPI 包的版本信息、历史发布及依赖，支持版本比较和批量查询，响应快速无须 API key。

This skill appears to perform the described public-registry lookups and does not request secrets or local file access, so it is low-risk in terms of credential exfiltration. However, the documentation overstates features (mentions batch queries and dependency info) that the included script doesn't fully provide — that inconsistency could be sloppy engineering or indicate an incomplete/untested skill. Before installing: (1) review the script if you need batch queries or dependency details (it currently handles single-package queries only), (2) be aware it requires outbound network access to npmjs.org and pypi.org, and (3) if you require the advertised features, ask the author for an updated implementation or patch the script yourself. If you need a security-strong recommendation, treat this as untrusted code until you validate it works as advertised.

Type: OpenClaw Skill Name: package-version-tracker Version: 1.0.1 The skill bundle is a legitimate utility for querying npm and PyPI package information. The Python script (scripts/package_version_tracker.py) uses standard libraries to fetch data from official registries (registry.npmjs.org and pypi.org) and contains no evidence of malicious behavior, data exfiltration, or command injection vulnerabilities.