从 JSON 样本推断结构草案。

This skill is inconsistent with its description. Before installing or running it: 1) be aware main.py does not perform schema inference — it only reports character counts and can perform HTTP GET/POST when run with --url or --endpoint and --payload. 2) The network options are not documented in SKILL.md and could be used to exfiltrate local file contents if invoked with those flags. 3) If you only need local schema drafting, either reject the skill or inspect and edit main.py to remove the --url/--endpoint code paths (or run it in an isolated sandbox without network access). 4) If you allow agent autonomy, ensure the agent cannot call the network-facing arguments; otherwise run the script manually with only --input and --output. 5) Ask the author for a corrected implementation that actually generates JSON Schema and for an explanation of why network operations are included.

Type: OpenClaw Skill Name: json-schema-drafter Version: 1.0.0 The skill is classified as suspicious due to a major discrepancy between its stated purpose and its actual implementation. While SKILL.md claims the tool is for drafting JSON schemas, main.py contains no schema inference logic; instead, it functions as a generic HTTP client capable of fetching remote URLs and exfiltrating local file contents to arbitrary endpoints via POST requests (using the --endpoint and --payload arguments). These high-risk network capabilities are not documented in the skill's instructions.