SKILLEMALL.ai
GitHub ↗ RU Sign in

CC company-due-diligence

企业尽职调查自动化工具。基于 Playwright/agent-browser 实现多数据源自动抓取，支持企查查、天眼查、东方财富、中国裁判文书网四个网站的综合信息抓取，生成专业尽调报告（含截图+Markdown+PDF）。

ClawHub Agent Skills author: guangningsun v1.0.1 MIT-0 35 files body ≈ 1 007 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process C 53/100 · Has gaps — weak spots: result and completion, when it triggers, inputs and preconditions

ProcedurePlaywrightInfrastructureAI and agentstype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
C
71/100
safety, quality, tests
Safety 60%
75
Quality 40%
66
Run on models
none yet
Process rating
C
53/100
Has gaps
Result and completion w 14
0
Inputs and preconditions w 11
0
Failures and branches w 10
0
the three weakest of ten parameters · all ten

How to improve

  1. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 25

✓ No critical or high findings

Medium and low: 25
  • low Obfuscation obf-base64-blob session/all-sites-auth.json:38
    Long base64-looking blob (quoted — discussed, not commanded)
    "value": "%7B%22di…_id%22%3A%22345269858%22%2C%22first_id%22%3A%2219…3cd%22%2C%22props%22%3A%7B%22%24la…ype%22%3A%22%E
    quoted
  • low Secrets in code secret-high-entropy-token session/all-sites-auth.json:70
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Secrets in code secret-high-entropy-token session/all-sites-auth.json:114
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Secrets in code secret-high-entropy-token session/all-sites-auth.json:178
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Exfiltration net-credential-use session/all-sites-auth.json:183
    Credential used in a network call (verify the destination is the intended service) (detector / deny-list definition)
    "value": "{\"identities\":{\"$identity_cookie_id\":\"19d0…3cd\",\"$identity_login_id\":\"345269858\"},\"distinct_id\":\"345269858\",\"lib\":{\"$l
    detector
  • low Obfuscation obf-hex-escape-chain session/all-sites-auth.json:183
    Escaped/char-code string obfuscation (quoted — discussed, not commanded)
    "value": "{\"identities\":{\"$identity_cookie_id\":\"19d0…3cd\",\"$identity_login_id\":\"345269858\"},\"distinct_id\":\"345269858\",\"lib\":{\"$l
    quoted
  • low Secrets in code secret-high-entropy-token session/all-sites-auth.json:188
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Obfuscation obf-base64-blob session/due-diligence.json:38
    Long base64-looking blob (quoted — discussed, not commanded)
    "value": "%7B%22di…_id%22%3A%22345269858%22%2C%22first_id%22%3A%2219…3cd%22%2C%22props%22%3A%7B%22%24la…ype%22%3A%22%E
    quoted
  • low Secrets in code secret-high-entropy-token session/due-diligence.json:70
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Secrets in code secret-high-entropy-token session/due-diligence.json:114
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Secrets in code secret-high-entropy-token session/due-diligence.json:178
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Exfiltration net-credential-use session/due-diligence.json:183
    Credential used in a network call (verify the destination is the intended service) (detector / deny-list definition)
    "value": "{\"identities\":{\"$identity_cookie_id\":\"19d0…3cd\",\"$identity_login_id\":\"345269858\"},\"distinct_id\":\"345269858\",\"lib\":{\"$l
    detector
  • low Obfuscation obf-hex-escape-chain session/due-diligence.json:183
    Escaped/char-code string obfuscation (quoted — discussed, not commanded)
    "value": "{\"identities\":{\"$identity_cookie_id\":\"19d0…3cd\",\"$identity_login_id\":\"345269858\"},\"distinct_id\":\"345269858\",\"lib\":{\"$l
    quoted
  • low Secrets in code secret-high-entropy-token session/due-diligence.json:188
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Obfuscation obf-base64-blob session/eastmoney_cookies.json:1
    Long base64-looking blob (quoted — discussed, not commanded)
    [{"name": "qgqp_b_id", "value": "218a…49c", "domain": ".eastmoney.com", "path": "/", "expires": 1808441711.923445, "httpOnly": false, "secure": false, "sameSite": "Lax"}, {"nam
    quoted
  • low Secrets in code secret-high-entropy-token session/eastmoney_cookies.json:1
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    [{"name": "qgqp_b_id", "value": "218a…49c", "domain": ".eastmoney.com", "path": "/", "expires": 1808441711.923445, "httpOnly": false, "secure": false, "sameSite": "Lax"}, {"nam
    quoted
  • low Secrets in code secret-high-entropy-token session/qcc_cookies.json:1
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    [{"name": "acw_tc", "value": "781b…36d", "domain": "www.qcc.com", "path": "/", "expires": 1773883505.994199, "httpOnly": true, "secure": false, "s
    quoted
  • low Obfuscation obf-base64-blob session/tianyancha_cookies.json:1
    Long base64-looking blob (quoted — discussed, not commanded)
    [{"name": "HWWAFSESTIME", "value": "1773881702701", "domain": "www.tianyancha.com", "path": "/", "expires": -1, "httpOnly": false, "secure": false, "sameSite": "Lax"}, {"name": "HWWAFSESID", "value":
    quoted
  • low Secrets in code secret-high-entropy-token session/tianyancha_cookies.json:1
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    [{"name": "HWWAFSESTIME", "value": "1773881702701", "domain": "www.tianyancha.com", "path": "/", "expires": -1, "httpOnly": false, "secure": false, "sameSite": "Lax"}, {"name": "HWWAFSESID", "value":
    quoted
  • low Secrets in code secret-high-entropy-token session/tyc-auth.json:48
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Obfuscation obf-base64-blob session/tyc-auth.json:82
    Long base64-looking blob (quoted — discussed, not commanded)
    "value": "%7B%22di…_id%22%3A%22345269858%22%2C%22first_id%22%3A%2219…7cb%22%2C%22props%22%3A%7B%22%24la…ype%22%3A%22%E
    quoted
  • low Secrets in code secret-high-entropy-token session/tyc-auth.json:114
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Exfiltration net-credential-use session/tyc-auth.json:164
    Credential used in a network call (verify the destination is the intended service) (detector / deny-list definition)
    "value": "{\"identities\":{\"$identity_cookie_id\":\"19d0…7cb\",\"$identity_login_id\":\"345269858\"},\"distinct_id\":\"345269858\",\"lib\":{\"$l
    detector
  • low Secrets in code secret-high-entropy-token session/tyc-auth.json:171
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted
  • low Secrets in code secret-high-entropy-token session/tyc-auth.json:177
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "name": "Hm_l…758",
    quoted

Files scanned: 35. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")

Process rating: all ten parameters 53/100

  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 0Failures and branches. Linear process with no failure handling
  • 0Progress reporting. Says nothing while it works
  • 20When it triggers. No condition that starts the skill
  • 100Tools and files. No external tools needed
  • 100Steps. 41 steps
  • 100Consistency. Name and required fields are in place
  • 100Execution cost. Instruction body is 1007 tokens
  • 100Running it twice. No mutating operations
  • low 10 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Description length 112: 120–800 characters recommended
  • +3Output format is not stated: the model decides each time
  • -4Absolute local paths (C:\Users, /home/…): not portable
  • -313 of 15 scripts are never mentioned in SKILL.md
  • +1No license
  • +2Single-language instructions
  • +4Structure: 25 headings
  • +3Step-by-step instructions: 41 items
  • +4Has examples (8 code blocks)
  • +4Reference files are cited in the instructions (2 of 2)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 66.

External checks

ClawHub: suspicious
The skill’s due-diligence purpose is mostly coherent, but it ships saved browser sessions with authentication tokens and uses unsafe shell command construction.
LLM: suspicious (high) · VirusTotal: · 29 May 2026