批量文件重命名工具，支持多种命名模式、正则表达式、预览和撤销功能。适用于需要批量整理文件的场景，如照片整理、文档归档、下载文件重命名等。

This package appears to be a local Python batch-renamer and does not try to exfiltrate data or access secrets — but there are coherence problems you should consider before installing or running it: - Documentation vs implementation mismatch: SKILL.md/README advise 'npm install -g batch-renamer' and state JavaScript regex syntax, while the bundled file is a Python script (batch_renamer.py). Do NOT run npm install unless you intend to install an npm package from the registry; that could fetch unrelated code. - Implementation bugs: apply_regex uses 're.GLOBAL' (which doesn't exist) and mixes JavaScript-style 's/.../.../' parsing with Python's re library. This will likely cause regex failures or exceptions. Expect to test with --preview first. - Safe testing steps: run the Python script directly (python3 batch_renamer.py) in a safe, small test directory or copy of your files; always use the --preview flag first to verify mappings; check the .batch-renamer-backup.json file before executing; keep a manual backup of important files. - Additional verification: if you plan to install a globally published package, confirm the package author and inspect the package contents (npm registry or source repo). If this skill will be used by others or in production, ask the author for provenance or a trusted release; resolving the npm vs python mismatch and fixing the regex handling would increase confidence. If you want, I can: 1) point out the exact lines to fix in apply_regex, 2) produce a corrected version of the script that properly supports 's/old/new/g' semantics in Python, or 3) draft safer installation/run instructions that avoid npm ambiguity.

Type: OpenClaw Skill Name: batch-renamer Version: 1.0.1 The batch-renamer skill is a legitimate utility for renaming files using patterns or regular expressions. The Python script (batch_renamer.py) uses standard libraries to perform filesystem operations and includes safety features like a preview mode and an undo function via a local JSON backup file. No evidence of data exfiltration, malicious execution, or prompt injection was found.