Skill Preflight Checker

技能预检检查器。在安装任何技能前进行安全检查，验证作者声誉、检查恶意脚本、分析权限需求，防止安装恶意技能。

This skill appears to be what it claims (a preflight checker) but there are some important cautions: (1) The metadata does not list required tools — the instructions expect npm, docker, jq, grep, tar, etc.; verify those are available and intended. (2) Follow the container test steps carefully: avoid mounting sensitive host folders into the container (do not mount your home or .ssh), run the container with network disabled if you only want static checks, and don’t run as root. Prefer npm pack + static analysis and offline scanning rather than running npm install on untrusted packages. (3) Ask the author to update the skill metadata to declare required binaries and to add safer, explicit container options (e.g., --network=none, no host mounts, use ephemeral temp directories). If you cannot verify or enforce those safeguards, run preflight checks in a fully isolated VM/sandbox rather than on your primary host.

Type: OpenClaw Skill Name: skill-preflight-checker Version: 1.0.0 The skill is a security auditing tool designed to inspect other packages for malicious behavior before installation. It uses standard utilities like `npm`, `grep`, and `docker` to check author reputation, scan for dangerous functions (e.g., `eval`, `exec`), and identify access to sensitive files (e.g., `.ssh`, `.env`) within target packages. The logic in `SKILL.md` and the provided `preflight_check.sh` script is consistent with its defensive purpose and lacks evidence of malicious intent, obfuscation, or data exfiltration.