Clone and analyze GitHub project code quality using DeepSeek AI

What to consider before installing: - This skill will clone the repository you give it and send sampled source files and a project structure to a remote API at ark.cn-beijing.volces.com. If the repo contains sensitive code, secrets, or private info, that data will be transmitted off-host. The SKILL.md does not warn about this. - The code contains a hard-coded API key constant. Embedded keys are dangerous and unexpected; ask the publisher why this key is present and insist on supplying credentials via environment variables instead. - The repo URL is interpolated directly into a shell command using child_process.exec, which can be exploited by specially crafted inputs (shell injection). Only pass trusted, well-formed GitHub URLs, or request the author replace exec with a safer method (e.g., execFile or a git library with argument escaping). - There is no install spec or declared dependencies; confirm the runtime environment will have Node and axios, or request a proper package manifest. - If you need this functionality but want to limit risk: run it in an isolated/sandboxed environment, use only public repositories you control, or request source changes (remove hard-coded key, add explicit env var for API key, sanitize inputs, and document data handling and retention). If you cannot verify the publisher or obtain a clean, dependency-declared package that removes the hard-coded key and addresses input sanitization and explicit data-sharing policies, treat this skill as risky and avoid installing it.

Type: OpenClaw Skill Name: github-code-analyzer Version: 1.0.0 The skill contains a critical command injection vulnerability in index.js because the 'repoUrl' parameter is passed directly into a shell command ('git clone') without adequate sanitization. Additionally, the code includes a hardcoded API key ('ARK_API_KEY') for the Volcengine/DeepSeek API, which constitutes a credential leak. While these represent significant security risks (RCE and credential exposure), they appear to be unintentional flaws rather than evidence of malicious intent.