Nova Skill Evolution Tracker — 技能进化追踪系统

Nova 炼化技能的自我进化追踪系统。 功能：版本记录 · 月度信息源监测 · 差异分析 · 更新建议通知。 适用场景：监控已炼化专家的最新动态，自动检测需要更新的内容， 防止 SKILL.md 随时间过时。 触发词：「skill更新」「版本记录」「专家动态」「技能进化」「监测」

This skill appears to be an incomplete or partially-implemented monitoring tool rather than clearly malicious, but there are important inconsistencies you should resolve before installing it in a live environment: - Missing credential declarations: The SKILL.md and comments describe calling an LLM for diff analysis and sending notifications via enterprise WeChat, but the package does not declare or request API keys or messaging credentials. Ask the author which environment variables or secrets are required (LLM_API_KEY, WECHAT_APPID/SECRET or webhook, etc.) and insist they be explicitly documented. - Confirm network behavior: The script lists many external URLs to be scraped (Twitter/LinkedIn/blogs). Verify exactly how fetching will be performed (HTTP clients), whether JavaScript-rendered pages are needed, and whether rate-limiting / robots.txt / access policies are respected. If you run it, run in a network-restricted or sandboxed environment until you review full network calls. - Review the rest of the script: The provided script was truncated; ask for the full source to confirm there are no hidden exfiltration paths, undisclosed endpoints, or arbitrary subprocess executions. Pay attention to any code that would POST data to third-party endpoints or read files outside /workspace/skills. - Least privilege and secrets handling: If you approve running it, provide only scoped credentials (e.g., a webhook token limited to the notification channel) and ensure any LLM API key has usage limits and monitoring. Avoid giving it access to broad cloud or company credentials. - Test in isolation: Run the tool in a sandboxed workspace with a small set of test skills and monitor network traffic and filesystem writes before enabling scheduled runs. If you can obtain the full script (untruncated) and a clear list of required environment variables and endpoints, that information would likely move this assessment toward 'benign' if everything is narrowly scoped and documented.

Type: OpenClaw Skill Name: skill-evolution-tracker Version: 1.0.0 The skill bundle is a legitimate tool designed to track version history and monitor updates for other expert-based skills. The Python script (scripts/skill_monitor.py) manages local JSON versioning and generates markdown reports, while the SKILL.md provides clear instructions for the agent to manage these updates. Although the script contains placeholders for LLM-based analysis and mentions external notifications, it lacks any functional code for data exfiltration, unauthorized execution, or persistence.