OpenClaw 安全检查面板（Python 3.7+ 兼容）。用户发送"启动安全检查"时触发，按四大类检查：接入安全、权限安全、执行安全、韧性安全。生成带 token 的临时 HTML 页面，含风险详情子页面和一键修复功能。

This skill largely does what it says (local security checks and a temporary web panel), but several red flags deserve attention: - Missing runtime declarations: start.sh and the script call external commands (openclaw, last, sudo, curl, git) though the registry metadata lists no required binaries. Expect failures or hidden prompts for sudo. Ensure these tools and privileges are acceptable before running. - Reads sensitive data: the script reads /var/log/auth.log, runs last, and scans your workspace for plaintext secrets. That is appropriate for a security scanner, but you should only run it on systems you control and after making backups. - Dynamically generated server: start.sh launches /tmp/security_panel_server.py which is not part of the published files. The security_check.py likely writes and then executes a server script — code executed from /tmp is not visible in the manifest and could perform additional actions (network calls, exfiltration). Before running, inspect the runtime-generated /tmp/security_panel_server.py and /tmp/security_report.json to ensure they contain only the expected server and HTML content. - Auto-fix behavior: the tool can perform 'one-click' fixes (file permissions, modifying config.json). Review suggested fixes and back up affected files before applying automated fixes. - Recommended mitigations: run this skill in an isolated environment (VM/container) first, examine the generated /tmp files before execution, ensure you have recent backups, and run with minimal necessary privileges (avoid running as root). If you want to proceed, ask the publisher for the server code (the file created in /tmp) and full script contents (untruncated) so you can review all runtime behavior. If you cannot inspect the generated server, do not run it on production hosts.

Type: OpenClaw Skill Name: claw-security-panel Version: 1.0.0 The bundle implements a security audit tool that performs highly intrusive data collection, including scanning the user's workspace for 'private_key', 'api_key', and 'token' (scripts/security_check.py), and reading shell history files like .bash_history and /root/.bash_history. While these actions are framed as security checks, they involve harvesting sensitive credentials and system logs. Furthermore, the start.sh script attempts to execute a missing server component (/tmp/security_panel_server.py) that is not included in the bundle, making the actual behavior of the web interface and its 'auto-fix' API unverifiable and potentially dangerous.