Six Dim Evaluator

L4 评估层 - 六维评估引擎。自动化执行六维评估（T/C/O/E/M/U），生成评估报告，提供改进建议。

This package is internally inconsistent: the documentation promises external integrations (ClawHub API, DB storage, log analysis, alerts) but the code only performs local file inspection with placeholder values. Before installing or running it: 1) Ask the author for the source repository and verify provenance (public git, commit history). 2) Confirm what external APIs/databases it will call and require explicit env var names and scopes (ClawHub API key, DB credentials). 3) Inspect package-lock.json for unexpected/obfuscated dependencies and run npm install only in a sandbox. 4) Run the code locally in a safe environment to verify behavior (no network connections, no writes to unexpected locations). 5) If you plan to allow the agent to execute shell or network actions on your behalf, only grant minimal, documented credentials and prefer short-lived credentials or scoped tokens. Because of the mismatch between docs and code, treat this skill as untrusted until the author clarifies intended external integrations and provides verifiable source.

Type: OpenClaw Skill Name: six-dim-evaluator Version: 0.1.0 The skill bundle requests high-privilege tools (Bash and Exec) to perform its stated purpose of evaluating other skills, which includes running Jest tests and analyzing code quality. While the provided logic in src/index.js is primarily analytical (reading files and calculating scores), the SKILL.md instructions explicitly direct the AI agent to execute shell commands for data collection. This is a high-risk capability because it involves executing potentially untrusted code from the skills being evaluated. No evidence of intentional malice, backdoors, or data exfiltration was found, but the broad permissions and execution-heavy workflow meet the threshold for a suspicious classification.