Yidun Skill Sec

Intelligent code security scanner with hybrid local-cloud detection. Fingerprints packages, runs static behavioral analysis, and consults cloud threat intell...

This skill appears to do what it says (a hybrid local-cloud scanner) and only needs curl/jq/openssl. The main risk is data you may not expect it to send: the SKILL.md says it uploads redacted code snippets and tags to a third‑party endpoint (as.dun.163.com). Because there is no implementation included, you cannot verify the redaction or exact upload rules. Before installing or enabling cloud mode: 1) Prefer running scans offline (set YIDUN_SKILL_SEC_CLOUD=false) on sensitive code or in an isolated environment. 2) If you plan to enable cloud analysis, test it first on non-sensitive packages to confirm what is sent. 3) Ask the author or vendor for the scanner implementation (or review it) to verify the local redaction pipeline and the exact file-read policies. 4) Limit network access (e.g., firewall) if you cannot audit the implementation. 5) If you use this skill in high-sensitivity contexts, require that cloud uploads be disabled or that the vendor provides a signed, auditable client implementation. These steps will reduce the chance that secrets or unexpected data are exfiltrated.

Type: OpenClaw Skill Name: yidun-skill-sec Version: 1.0.1 The skill is a security scanner that performs static behavioral analysis and uploads file hashes and redacted code snippets to a cloud intelligence endpoint (as.dun.163.com). While its actions are consistent with its stated purpose of threat detection, it requires high-risk capabilities including broad filesystem access and outbound network communication to a third-party service. The documentation describes a detailed 'Local Redaction Pipeline' to mitigate data leakage, but the inherent risk of transmitting code-derived metadata and the potential for sensitive data to bypass redaction logic warrants a suspicious classification under the provided criteria.