Sx Security Audit 1.0.0

全方位安全审计技能。检查文件权限、环境变量、依赖漏洞、配置文件、网络端口、Git 安全、Shell 安全、macOS 安全、密钥检测等。支持 CLI 参数、JSON 输出、配置文件。当用户要求"安全检查"、"漏洞扫描"、"权限检查"、"安全审计"时使用此技能。

This skill appears to be what it says: a local security audit that scans files, env vars, git history, dependencies, and can send formatted reports to Feishu. Before installing or running it: - Review ~/.openclaw/openclaw.json for any plugin apiEndpoint or webhook settings the script could use to send data; if you don't want report upload, don't configure a webhook or OpenClaw Feishu plugin. - Run audits in a controlled environment (or set excludePaths in .security-audit.json) so the tool doesn't read directories you consider too sensitive (e.g., backup directories, vaults). - Expect the tool to include detected secrets in reports; if you will send reports to external endpoints, rotate any secrets accidentally disclosed. - If you plan automated runs, prefer --json --output report.json and inspect the report offline before sending it to any webhook. - Check for required system utilities (npm, lsof) and run without root unless you intentionally need privileged checks. Confidence is medium because some portions of scripts were truncated; if you want higher confidence, provide the full security_audit.py and send_report_to_feishu.py contents so I can verify there are no hidden network endpoints, no unexpected exec calls that perform exfiltration, and exactly how subprocess/network operations are invoked.

Type: OpenClaw Skill Name: sx-security-audit-1-0-0 Version: 1.0.0 The skill bundle is a comprehensive security auditing tool that performs high-risk operations, such as scanning sensitive directories (~/.ssh, ~/.aws), reading environment variables, and parsing shell history files (~/.bash_history, ~/.zshrc) for secrets. While these actions are clearly aligned with the stated purpose in SKILL.md and scripts/security_audit.py, the tool's ability to collect and transmit summaries of this sensitive data (including partial secret strings) to external Feishu webhooks via scripts/send_report_to_feishu.py constitutes a significant security risk. There is no evidence of intentional malice, but the broad access to system credentials and configuration files meets the threshold for a suspicious classification.