Platform Script Skills

提供自研业务平台的脚本模板和编码规范。当用户需要编写 Groovy 后端脚本、JavaScript 表单脚本、SQL 查询、附件处理等代码时使用此技能。

This skill appears to be what it says: a set of platform-specific script templates and coding rules. Before using it in production, do the following: 1) Audit the bundled templates — do NOT copy-and-paste examples that print or modify account passwords, reset credentials to hardcoded values, or perform broad deletes. 2) Review SQL templates for unsafe string concatenation (risk of SQL injection) and prefer parameterized queries. 3) Test generated scripts in a sandbox/staging environment with limited privileges. 4) Require manual code review and approval before deploying any generated script that touches user accounts, credentials, or deletion/update operations. 5) Verify the skill source/trustworthiness if you need long-term use; if you cannot verify the origin, restrict who can invoke it. If the skill later requests external endpoints, environment variables, or an install script that downloads code, re-evaluate as those would raise stronger concerns.

Type: OpenClaw Skill Name: platform-script Version: 1.0.1 The skill bundle provides a comprehensive set of Groovy and JavaScript templates for a specific business platform, but it contains high-risk code examples in 'references/platform-script-templates.txt'. Specifically, it includes a 'Listener Script Example' that iterates through the entire 'gdmp_account' table and resets passwords for all users (except 'admin' and 'guest') to a hardcoded value ('123456'). It also contains hardcoded external email addresses (e.g., [email protected] and [email protected]) within its notification templates, which could lead to accidental data exposure if used without modification.