← 返回 Skills 市场

android build tool

Name: android build tool
Author: noah-smith-max

作者 noah-smith-max · GitHub ↗ · v0.0.2

cross-platform ⚠ suspicious

375

总下载

当前安装

版本数

在 OpenClaw 中安装

/install android-build

功能描述

A tool for downloading and configuring Android SDKs for projects, supporting Windows and macOS. Invoke when user needs to manage mobile SDKs, configure proje...

使用说明 (SKILL.md)

Pi Project

A tool for downloading and configuring Android SDKs for projects, supporting Windows and macOS.

Features

Environment Detection

Project detection
Proxy detection (Use proxy for chinese network if proxy detected)

Dependency Detection

Detect version information for:

Flutter
Android ecosystem (Gradle, Build Tools, SDK, NDK, cmake)
JAVA

Check & Download

Check if dependencies are installed
Download missing dependencies

Environment Config

Configure environment variables for the project to be used by code editors
Configure necessary global environment variables
For SDKs with strict version sensitivity (e.g., Flutter), configure shortcut commands in the project root directory

Build

Build the project from source code

Usage

Using pi_claw.py (Recommended)

Run python pi_claw.py help to show help information
Run python pi_claw.py detect /path/to/your/project to detect project dependencies
Run python pi_claw.py /path/to/your/project to download SDK and configure project
Run python pi_claw.py build /path/to/your/project to build the project from source code

Using pi directly

Run pi help to show help information
Run pi detect /path/to/your/project to detect project dependencies
Run pi /path/to/your/project to download SDK and configure project
Run pi build /path/to/your/project to build the project from source code \x3Cimg width="1550" height="1262" alt="Image" src="https://github.com/user-attachments/assets/1f39cd73-5f2a-484f-9351-05d5c43459c9" />

Supported Platforms

Windows
macOS

Supported Project Types

Android projects
Flutter + Android projects

Download

安全使用建议

This skill works by downloading and executing a helper binary (pi.exe/pi) from a GitHub Releases URL at runtime. That makes its behavior dependent on whatever code is in that remote binary — which is not included or verified. Before installing or running it: 1) Review the upstream release page and vendor identity (who controls noah-smith-max/pi_public) and confirm you trust that source. 2) Ask the skill author for checksums/signatures or for the helper's source code so you can verify what will run. 3) Avoid running it on production or sensitive systems; test in an isolated VM or disposable environment. 4) Prefer a version that includes integrity verification (SHA256/GPG) or a pure-Python implementation instead of executing an unsigned binary. 5) Note the script only supports Windows/macOS (it exits on Linux). If you accept the risk, consider improving the wrapper (use subprocess.run with argument lists to avoid shell-joining, validate TLS/release integrity, and pin a specific release).

功能分析

Type: OpenClaw Skill Name: android-build Version: 0.0.2 The `pi_claw.py` script is highly suspicious due to a critical shell injection vulnerability. It uses `os.system(' '.join(args))` where `args` includes unsanitized user input (`sys.argv[1:]`), allowing for arbitrary command execution if a malicious string is passed as an argument. Additionally, the script downloads and executes an external, unverified binary (`pi` or `pi.exe`) from a GitHub release URL (e.g., `https://github.com/noah-smith-max/pi_public/releases/download/r0.0.1/pi.exe`), introducing a significant supply chain risk by running code from an external source without validation. While the `SKILL.md` does not contain malicious prompt injection, the underlying Python script presents severe security flaws.

能力评估

ℹ Purpose & Capability

The name/description (Android SDK management) match the included Python wrapper which downloads and runs a helper 'pi' binary to perform tasks. Requesting a helper executable is plausible for this purpose, so the overall capability aligns with the stated purpose.

⚠ Instruction Scope

The runtime instructions (run pi_claw.py) cause the skill to download an external binary and execute it. While this is related to the stated task, the instructions grant the skill authority to fetch and run arbitrary remote code (the contents of the 'pi' binary are not included), which expands scope beyond what a pure instruction-only skill typically does.

⚠ Install Mechanism

The Python script downloads an executable from GitHub Releases and executes it. Although GitHub releases is a known host, there is no checksum/signature verification, no pinned release artifact, and the binary is executed immediately. Download+extract/execute of remote binaries without integrity checks is a high-risk install pattern.

✓ Credentials

The skill declares no required environment variables, credentials, or config paths and the code does not read any secrets. The requested environment access is minimal and proportionate to the task as described.

ℹ Persistence & Privilege

The script writes the downloaded 'pi' binary into the same directory as pi_claw.py and executes it. This is a local write and not a platform-wide persistence request (always:false). Still, writing and running an executable on disk increases attack surface and should be considered before use.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install android-build
安装完成后，直接呼叫该 Skill 的名称或使用 /android-build 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.0.2

support flutter-android, mac and windows.

元数据

Slug android-build

版本 0.0.2

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题