Zero2ai Security Audit

Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects...

This skill appears to be what it says: a local pre-publish/pre-commit scanner implemented in Python. Before installing or using it: 1) Review scripts/audit.py yourself to confirm you agree with its patterns and exclusions (it intentionally excludes certain directories and has a whitelist of 'safe' placeholders). 2) Update SKILL.md paths and the 'Report to Aladdin' text to match your environment so the doc doesn't leak a template user. 3) Note the scanner calls 'git' and reads repository files (normal for this use) and only prints or emits JSON — there are no network calls or credential requirements in the included code. 4) If you plan to let an autonomous agent run this skill automatically, ensure you trust the agent to run arbitrary local scans; the script does not exfiltrate data but will read repository contents. If you want extra assurance, run the script manually on a test copy of your repo to validate results and behavior.

Type: OpenClaw Skill Name: zero2ai-security-audit Version: 1.0.0 The OpenClaw AgentSkills bundle 'zero2ai-security-audit' is a benign security auditing tool. Its `SKILL.md` provides clear, non-malicious instructions for an AI agent to run `scripts/audit.py` for detecting hardcoded secrets, API keys, and sensitive patterns in code. The `audit.py` script uses standard Python libraries, defines comprehensive regex patterns for various secrets and risky configurations, and includes heuristics like entropy checks and safe value lists to reduce false positives. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts designed to harm the agent or system. The use of `subprocess` for `git diff` is appropriate for its stated purpose.