Scan Report
5 /100
reviewlens
评论透镜 - 把海量商品评论压成结论卡，告诉你真实买家反复在夸什么、骂什么，谁适合买，谁容易踩坑
ReviewLens is a benign review-intelligence skill that analyzes Chinese e-commerce marketplace reviews into decision cards. The single shell script (publish.sh) is a standard clawhub CLI publishing utility with no malicious patterns.
Safe to install
Approve for use. The skill performs only declared read-only review analysis with no hidden functionality.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | READ | ✓ Aligned | SKILL.md:288 — reads reference/*.md files for review heuristics |
| Network | NONE | READ | ✓ Aligned | SKILL.md:296-300 — browser inspects public review tabs only |
| Shell | NONE | NONE | — | scripts/publish.sh runs clawhub CLI for publishing, fully declared and documente… |
| Environment | NONE | NONE | — | No environment variable access detected in any file |
| Clipboard | NONE | NONE | — | No clipboard access found |
| Browser | READ | READ | ✓ Aligned | SKILL.md:296-300 — browser workflow only for public review tab inspection |
| Database | NONE | NONE | — | No database access found |
| Skill Invoke | NONE | NONE | — | No inter-skill invocation found |
File Tree
9 files · 26.1 KB · 823 lines Markdown 6f · 730L
Shell 1f · 66L
JSON 1f · 23L
YAML 1f · 4L
├─
▾
agents
│ └─
openai.yaml
YAML
├─
▾
references
│ ├─
example-prompts.md
Markdown
│ ├─
fit-mismatch.md
Markdown
│ ├─
review-signals.md
Markdown
│ └─
verdict-cards.md
Markdown
├─
▾
scripts
│ └─
publish.sh
Shell
├─
clawhub.json
JSON
├─
RELEASE.md
Markdown
└─
SKILL.md
Markdown
Security Positives
✓ No credential harvesting — skill never accesses environment variables, SSH keys, AWS configs, or .env files
✓ No network exfiltration — no outbound data transfer beyond intended clawhub publish command
✓ No obfuscation — no base64, eval, atob, or anti-analysis patterns anywhere in the codebase
✓ No remote script execution — no curl|bash, wget|sh, or similar download-and-execute patterns
✓ Clear safety boundary — SKILL.md explicitly forbids login, posting reviews, or placing orders
✓ Shell script is a simple publishing utility — uses set -eu for strict error handling, copies files only, no network abuse
✓ No supply chain risk — no package dependencies, no requirements.txt, no unpinned pip installs
✓ Strong doc-to-code alignment — SKILL.md declarations match implementation exactly
✓ No sensitive file access — never touches ~/.ssh, ~/.aws, or similar credential paths
✓ Intent is transparent — skill is purely a review-analysis text-processing tool