Repo Research

GitHub 仓库深度研究与整合分析工具。支持单个/多个仓库研究、与本地项目对比分析、启发式整合建议。支持主题驱动搜索模式：自动搜索相关仓库、克隆、分析并生成报告。克隆远程仓库到本地 research/ 目录，进行深度代码分析、架构评估、依赖解析，并生成结构化研究报告。触发条件：用户提供 GitHub URL 请...

This skill appears to do what it claims: clone GitHub repositories, analyze their code, and produce reports. Before running it, consider the following: (1) It assumes git and Python (python3) are available though these are not declared — ensure those binaries exist. (2) It will create directories and clone code into the configured output_dir (defaults to ./research or your current working directory) — run it from a directory where writing/cloning is safe, or set output_dir to a sandbox. (3) If you use the 'compare with local path' mode, the skill will read arbitrary local files at the path you provide — only supply directories you trust. (4) The skill may call platform commands like /skill-manager or /find-skills when using theme search; those commands are platform-specific and may prompt additional installs. (5) Review scripts/security.py (included) to understand what the built-in security checks look for. (6) As a general precaution, do not execute code from cloned repositories; the skill appears to analyze files but not run repository code — still review before running anything from the cloned repos. If you want stricter assurance, run the skill in an isolated environment (container or VM) and inspect scripts/security.py and scripts/* for any unexpected subprocess invocations before use.

Type: OpenClaw Skill Name: repo-research Version: 0.7.0 The repo-research skill bundle is a comprehensive tool for automated GitHub repository analysis, including architectural mapping, code quality metrics, and security auditing. The bundle contains several specialized Python scripts (architecture.py, quality.py, security.py) that perform static analysis on cloned repositories to generate detailed research reports. Notably, the security module (scripts/security.py) implements extensive regex-based detection for common vulnerabilities, hardcoded secrets, and prompt injection attacks in target repositories. The tool's behavior, including its dependency management and configuration logic (scripts/config.py), is transparently documented and aligns strictly with its stated purpose of providing project insights and security evaluations.