PDCA+ISO9001质量管理

PDCA+ISO9001质量管理决策系统技能 - 基于PDCA循环和ISO9001质量体系的AI决策质量管控技能，实现任务全生命周期管理、标准化流程、持续改进

This skill appears coherent with its stated PDCA/ISO9001 purpose, but you should not install it blindly. Before deploying: 1) Inspect scripts/utils.py and any truncated/omitted files to see what send_notification, auto-learning, and any networking functions do and whether they contact external endpoints or expect credentials. 2) Search for any hard‑coded URLs, API keys, or calls to requests/urllib/subprocess that could exfiltrate data. 3) Run the skill in an isolated sandbox or VM and monitor outbound network traffic and filesystem writes (data/, knowledge_base/, reports/). 4) If integrating with real communication channels (webchat, LCM), ensure you provide explicit, least-privilege credentials and understand where data will be sent. 5) If you lack the ability to review the omitted utility code, treat the skill as untrusted and avoid running it on sensitive systems or with administrative privileges.

Type: OpenClaw Skill Name: quality-management-pdca Version: 1.0.0 The skill bundle implements a comprehensive quality management system based on PDCA and ISO9001 principles. However, it contains a critical security vulnerability in `scripts/knowledge_manager.py`, where the `eval()` function is used to evaluate rule conditions. This poses a significant risk of Remote Code Execution (RCE) if an attacker can inject malicious strings into the rule library (e.g., through the 'auto-learning' feature that extracts rules from project data). While the code appears aligned with its stated purpose and lacks clear evidence of intentional malice or data exfiltration, the use of `eval()` on potentially untrusted data is a high-risk implementation flaw.