Agent Defender - AI智能体安全防护平台。静态扫描+运行时防护+DLP脱敏。触发：(1)扫描Skill (2)启动防护 (3)DLP检测 (4)安全审计

What to check before installing or running this skill: - Review network/sync code: open sync_from_lingshun.py, research_daemon.py, integrate_scanner_v4.py and defenderctl.sh and search for outbound network calls (requests, urllib, socket, subprocess calling curl/wget) and any hard-coded endpoints. Confirm whether external credentials or endpoints are required and where they would be stored. - Inspect persistence scripts: defenderctl.sh and research_daemon.py create PID/state files and can run continuously. Decide whether you want that background behavior; run the service in a sandbox or container first. - Audit actions with side effects: locate any code that writes, deletes, or executes system commands (os.system, subprocess, open files under /etc or home) and verify they match expected behavior (scanning, logging, backups) — e.g., backup_manager.sh and any 'run-once' scripts. - Validate DLP/rule behavior: integrated_rules/ contains many rules. Confirm blocking actions are safe (do not auto-delete data or send secrets to remote endpoints). Test the scanner on non-production samples to evaluate false positives/negatives. - Run in isolation first: execute the tools in an isolated environment (container, VM, or offline machine) and monitor outbound connections and file changes. - If you plan to enable the auto-research/sync features, require explicit documentation of what remote service (’灵顺 V5’) is, what credentials it needs, and whether synced content is trusted. If undocumented, treat sync as potentially risky. Because of the mismatch between claimed local-only usage in SKILL.md and the repository’s automatic research/sync components (plus the prompt-injection detection strings present in rules), exercise caution and prefer manual review or sandboxed testing before granting persistent or network-enabled operation.

Type: OpenClaw Skill Name: agent-defender Version: 1.0.0 The 'agent-defender' skill bundle is a comprehensive security framework designed for AI agents, providing static code scanning, Data Loss Prevention (DLP), and runtime monitoring. The bundle includes a 'research_daemon.py' for automated rule iteration and several integration scripts (e.g., 'integrate_sigma_yara.py') to convert external security signatures into internal formats. While the codebase contains numerous high-risk strings and patterns (such as 'os.system', 'id_rsa', and 'curl|bash'), these are strictly utilized as detection signatures within the 'scanner_v2.py' logic or as part of the extensive test suites and benchmark reports. The execution logic is transparent, well-documented, and entirely consistent with the stated purpose of providing a defensive security layer.