Skill Audit Pro

AI Agent技能安全扫描工具。自动扫描已安装的OpenClaw技能，发现安全隐患。支持定时扫描（每24小时），自动发送报告到配置的所有Channel（Telegram/飞书等）。检测硬编码凭证、Shell注入、网络泄露等安全威胁。

This skill appears to be what it says: a local static scanner that enumerates installed skills and prints a report intended to be delivered to the agent's configured channels. Before installing, consider: 1) Source provenance — the package has no homepage and an unknown owner; prefer skills from known sources. 2) Review ~/.openclaw/agents/.../sessions.json and ~/.openclaw/openclaw.json contents (or inspect the code paths) to confirm no sensitive tokens would be exposed by discovery heuristics. The scripts only read channel metadata (channel/to), they do not post externally themselves, but printed channel data may appear in outputs. 3) If you want scheduled scans, verify how your OpenClaw deployment schedules skills — the package itself does not create cron jobs. 4) If you have strict secrecy requirements, run the scanner in a restricted/test environment first or review/execute the code manually. If anything in the package is unclear, ask the publisher for source verification or a signed release before enabling autonomous runs.

Type: OpenClaw Skill Name: skill-audit-pro Version: 1.0.0 The skill functions as a security auditor but performs high-risk operations, including broad filesystem scanning and reading sensitive session/configuration files (`sessions.json`, `openclaw.json`) to discover active communication channels. While these actions in `scripts/scan_and_report.py` and `scripts/skill_audit.py` are plausibly aligned with the stated purpose of sending automated security reports to all user channels, the access to session metadata and the automated 24-hour execution cycle represent a significant privilege level that could be abused.