Source To Architecture

实现从源码解析到五层架构的全链路可视化，支持版本控制、自动同步和多格式架构图生成。

This skill largely does what it says (analyze code and generate DrawIO diagrams), but there are mismatches between its claims and the delivered code. Before installing or running: - Review the install script (scripts/install-tools.sh). It performs global npm installs and uses apt/yum/brew (may call sudo). Prefer running these steps inside a disposable container/VM rather than on your workstation. The Dockerfile provided is a safer option. - Don’t run the analyzer against sensitive or production repositories until you inspect the code—the analyzer reads all files under the given project path and there is no exclusion configuration shown. - The README/SKILL.md promise automated features (weekly sync, PR/commit integration, sensitive-change alerts). These features are not present in the shipped scripts; treat them as planned features rather than working automation. - Validate the external packages (drawio-desktop from npm, ripgrep .deb URL) and consider installing them via your distribution’s package manager where possible to reduce supply-chain risk. - Run the tool first in an isolated environment (container) and test on a non-sensitive sample project. If you need the promised automation (hooks/scheduling/alerts), request the author for the specific implementations or source for the CI/git hooks before trusting auto-sync behavior. If you want higher confidence, provide the full, untruncated drawio-generator.py (the copy in the package appears truncated/buggy) and confirm whether any post-install scripts or network calls are made by npm packages used.

Type: OpenClaw Skill Name: source-to-architecture Version: 1.0.0 The skill bundle is designed to automate the generation of architecture diagrams from source code. It includes scripts for environment setup (install-tools.sh), source code analysis (source-analyzer.py), and DrawIO diagram generation (drawio-generator.py). The behavior is consistent with the stated purpose, using standard system utilities like ripgrep and tree to map code structures to a five-layer architecture. No evidence of data exfiltration, unauthorized remote execution, or malicious prompt injection was found.