Openclaw Cnc Core

🦞 OpenClaw CNC 智能报价系统核心框架 - 支持 STEP 解析、智能报价、风险控制

This package appears to implement the described CNC quote functionality, but exercise caution before running it on a machine with sensitive data. Key points: 1) The code uses absolute workspace paths (e.g. /home/admin/.openclaw and ~/.openclaw) — it will read/write SQLite DBs and config files there; if you have existing data in those locations the skill may read or modify it. 2) quote_engine modifies sys.path to include your workspace and then imports a local module named data_layer — that import will execute Python from that directory if present, which is a potential code-execution vector. 3) The skill will perform outbound calls to LLM/vector provider endpoints if you supply API keys; only provide keys you trust and prefer least-privileged keys. Recommended actions: run the code in an isolated environment (container or VM), inspect or rename any existing ~/.openclaw or /home/admin/.openclaw files beforehand, search for and review any data_layer module in your environment, avoid supplying production API keys until you validate behavior, and consider editing the code to use a controlled workspace path or to remove the sys.path insertion before use.

Type: OpenClaw Skill Name: openclaw-cnc-core Version: 1.2.1 The OpenClaw CNC Core bundle is a legitimate intelligent quoting engine for the CNC machining industry. It includes modules for parsing 3D STEP files (core/step_2d_validator.py), calculating costs based on material and complexity (core/quote_engine.py), and retrieving historical pricing data using a hybrid rule-based and vector-based approach (core/hybrid_retriever.py). While it contains a utility script (scripts/push_to_remotes.sh) that handles Git credentials and uses force-pushing, this is presented as a developer tool for repository management rather than a malicious payload. The code follows standard practices for its stated purpose, including parameterized SQL queries and documented LLM provider integrations.