Skill Auditor (于松涛版)

安全审计OpenClaw技能，检测文件操作、网络请求、命令执行、权限和数据泄露等安全风险并生成报告。

This skill appears to be what it says: a local static auditor that reads files under a path you provide and reports matches against configurable regex rules. Before running it: (1) only audit skill project directories you control or trust — do not point it at /, your home directory, or other sensitive locations; (2) expect false positives (allowed_imports is conservative and will flag many imports by default); (3) you can review/adjust audit_config.json (patterns, allowed_imports) to reduce noise; (4) the tool does not perform network calls or exfiltrate data, but it will read any file under the supplied path — treat that as a local read-only operation. If you want extra safety, run it in a sandboxed environment or on a copy of the skill files.

Type: OpenClaw Skill Name: yusongtao-skill-auditor Version: 1.0.0 The skill is a static analysis tool designed to audit other OpenClaw skills for security risks. It uses regex-based pattern matching in auditor.py to identify dangerous functions (e.g., eval, exec, os.system) and unauthorized imports. The requested permissions are limited to file system read access, which is consistent with its stated purpose, and no evidence of malicious intent or data exfiltration was found.