安全审核标准 - 自动化版

自动扫描 workspace/skills 目录中多种文件，识别风险关键词，生成安全审计报告并给出安装建议。

This skill appears to do what it claims: it reads files under /workspace/skills, searches for listed risky keywords, and writes a Markdown+JSON report to /workspace. Before installing or enabling it, consider: (1) it will read any secrets stored in /workspace/skills — ensure no sensitive credentials are there or rotate them after a scan; (2) substring matching is brittle: expect false positives (keywords in comments or docs) and some bypasses (obfuscated code or renamed files); (3) the filename-based whitelist can be abused by a file named to appear safe — review whitelist patterns if you rely on automatic exclusions; (4) run the scanner manually in a sandbox first (python3 scan_skills.py) to inspect the produced report and confirm it behaves as expected; (5) because it has read access to your skills directory, prefer running it in an environment with limited permissions or inspect its source (scan_skills.py) yourself — the code is short and readable. If you need, I can list exact lines where the scanner: (a) defines the keyword lists, (b) performs substring matching, and (c) writes the report so you can review them quickly.

Type: OpenClaw Skill Name: skill-vetter-2 Version: 1.0.0 The skill bundle is a security auditing tool designed to scan other skills in the `/workspace/skills/` directory for risky code patterns (e.g., `eval`, `os.system`, network calls). The implementation in `scan_skills.py` performs static string matching and generates local Markdown and JSON reports. There is no evidence of data exfiltration, unauthorized execution, or malicious intent; the behavior is entirely consistent with its stated purpose as a defensive utility.