huawei-cloud-officeace-expert-migration@1.0.0
CAUTION· static onlyPublisher claims: "把 WorkBuddy、千问办公（QwenWork）或百度搭子（DuMate）的专家、专家团/专家套件迁移成 OfficeAce 可用的专家卡、技能目录与专家团时使用。**强制第一步**：执行任何迁移动作前必须先问用户「这次迁移是跨机器的吗？」，得到答复前禁止运行任何迁移器的 --install（1.6.0 起 migrate.py / migrate_workbuddy.py / migrate_suite.py 三者共用脚本级闸门 migration_gate.py，直接调用子迁移器同样被拦截；跨机器时指导用户先把专家包传到本机再按路径迁移）。**支持一句话迁移**：用户说「把 X 迁过来 / 把这个专家团装到 OfficeAce」时，用 ~/.office-claw/skills/huawei-cloud-officeace-expert-migration/scripts/migrate.py 一个命令自动定位源包、识别平台、选迁移器、装完自检并自动同步应用镜像目录，不需要用户给路径或指定脚本。覆盖格式识别、字段映射、技能正文改写、专家卡/团队注册、头像落地、安装与十一项校验全流程。1.2.0 起以「迁移完即可用」为验收线：人设取全文、技能按角色分工、脚本改绝对路径、运行配置取自本机 model.json、主理人与成员全部进专家目录，装完直接派任务即可跑。触发词：迁移专家、迁移专家团、专家套件迁移、套件移植、把套件装到 OfficeAce、把这个专家迁过来、帮我把专家团搬过去、专家包转换、plugin 转 expert、qwenwork 套件、dumate 套件、workbuddy 专家、workbuddy 专家团、有哪些专家可以迁、专家卡不存在、专家列表里没有、主理人出错、专家团跑不起来、成员人设一样、技能加载不到、专家头像乱码、头像不显示、头像是一块纯色、换专家头像、镜像不同步、改了技能没生效。" Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-12 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.No other findings across 6,600 lines in 23 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim huaweicloudskill: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.