Skill Tracker

🌪️ 旋旋 - AI Agent 技能追踪系统，自动追踪使用情况、健康度评分、优化建议

This skill is coherent with its description and runs entirely on local files, but review before installing: - Audit stored data: the scripts create JSONL health and usage files under ~/.openclaw/data/gungun/ and markdown reports under your workspace. Check these directories for sensitive content and set restrictive file permissions (600/700) if needed. - Sanitize inputs: the code writes proposals using the skill_name directly into filenames (pending/<skill_name>.json). If a skill can supply an arbitrary name, a malicious or buggy skill could craft a name with path components (e.g., "../../.ssh/authorized_keys") to write outside the intended directory. Only accept logs from trusted skills or modify the scripts to sanitize/slugify skill names before writing files. - Control what is logged: the logger accepts a metadata dict and user_satisfaction values. Ensure other skills do not log PII, secrets, or user content into these fields — or implement filtering/encryption before writing. - Cron and workspace paths: setup-cron.sh provides sample crontab lines but doesn't install them automatically. If you enable scheduled runs, ensure the cron jobs run as the intended user and log files (in /tmp) are protected. If you trust the environment and will restrict which skills can call log_skill_usage (or patch the code to sanitize names and limit metadata), the skill is reasonable to use. If you cannot guarantee that only trusted skills will report usage, consider fixing the filename handling and adding input validation/encryption before deploying.

Type: OpenClaw Skill Name: xuanxuan Version: 1.0.0 The 'xuanxuan' (skill-tracker) bundle is a monitoring and analytics tool designed to track the performance, success rates, and health of other OpenClaw skills. The provided Python scripts (collect-usage.py, calculate-health.py, generate-proposals.py, and generate-report.py) perform local data logging and analysis within the user's home directory (~/.openclaw). The bundle includes a shell script (setup-cron.sh) for optional automation of these tasks via crontab. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the code is transparent, well-documented, and aligns strictly with its stated purpose of skill self-evolution and optimization.