← 返回 Skills 市场

clawsec-clawhub-checker

Name: clawsec-clawhub-checker
Author: davida-ps

作者 davida-ps · GitHub ↗ · v0.0.3 · MIT-0

cross-platform ✓ 安全检测通过

389

总下载

当前安装

版本数

在 OpenClaw 中安装

/install clawsec-clawhub-checker

功能描述

ClawHub reputation checker for clawsec-suite. Adds a standalone reputation gate before guarded skill installation.

使用说明 (SKILL.md)

ClawSec ClawHub Checker

Adds a reputation gate on top of the clawsec-suite guarded installer.

Operational Notes

Required runtime: node, clawhub, openclaw
Depends on: installed clawsec-suite
Side effects: none on other skills; this package does not rewrite installed suite files
Advisory-hook wiring is optional and manual in this release
Network behavior: reputation checks call ClawHub inspect/search endpoints
Trust model: scores are heuristic and confirmation-gated

What It Does

Reads skill metadata from ClawHub (inspect --json)
Evaluates scanner status (including VirusTotal summary when present)
Applies additional reputation heuristics (age, updates, author history, downloads)
Requires explicit --confirm-reputation when score is below threshold

Installation

Install after clawsec-suite:

npx clawhub@latest install clawsec-suite
npx clawhub@latest install clawsec-clawhub-checker

Optional preflight check (validates local paths and prints recommended command):

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/setup_reputation_hook.mjs

Usage

Run the enhanced installer directly from this skill:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0

If a skill is below threshold, rerun only with explicit approval:

node ~/.openclaw/skills/clawsec-clawhub-checker/scripts/enhanced_guarded_install.mjs \
  --skill some-skill \
  --version 1.0.0 \
  --confirm-reputation

Optional Advisory-Hook Wiring (Manual)

This release does not auto-patch clawsec-suite hook files.
If you rely on advisory alerts that include reputationWarning / reputationWarnings, wire the checker module manually:

Source module: ~/.openclaw/skills/clawsec-clawhub-checker/hooks/clawsec-advisory-guardian/lib/reputation.mjs
Target hook file: ~/.openclaw/skills/clawsec-suite/hooks/clawsec-advisory-guardian/handler.ts

Treat that wiring as a deliberate local customization and review it before enabling.

Exit Codes

0 safe to install
42 advisory confirmation required (from clawsec-suite)
43 reputation confirmation required
1 error

Configuration

Environment variables:

CLAWHUB_REPUTATION_THRESHOLD - Minimum score (0-100, default: 70)

Safety Notes

This is defense-in-depth, not a replacement for advisory matching
Scanner outputs can produce false positives and false negatives
Always review skill code before overriding warnings

Development

Key files:

scripts/enhanced_guarded_install.mjs
scripts/check_clawhub_reputation.mjs
scripts/setup_reputation_hook.mjs
hooks/clawsec-advisory-guardian/lib/reputation.mjs

License

GNU AGPL v3.0 or later - Part of the ClawSec security suite

安全使用建议

This package appears to do exactly what it claims: run ClawHub inspections and apply a reputation heuristic before delegating to the clawsec-suite installer. Before installing: (1) confirm you trust the clawhub and clawsec-suite binaries on your system, since the scripts call them; (2) review the provided scripts (especially enhanced_guarded_install.mjs and check_clawhub_reputation.mjs) if you plan to wire the optional hook into clawsec-suite; (3) be aware the enhanced installer forwards your process environment to the original installer (so any env-held secrets would be available to that child process); and (4) note the behavior is 'fail closed' when scanner metadata is missing — you may encounter blocked installs for packages lacking ClawHub scanner data. If you need higher assurance, run the scripts locally in a controlled environment and inspect outputs before enabling them in production.

功能分析

Type: OpenClaw Skill Name: clawsec-clawhub-checker Version: 0.0.3 The skill is a security utility designed to provide reputation scoring for OpenClaw skills by querying ClawHub metadata. It implements robust input validation using regular expressions for skill slugs and versions in 'check_clawhub_reputation.mjs' and 'enhanced_guarded_install.mjs', preventing shell injection. The code follows its stated purpose of adding a defense-in-depth reputation gate and correctly delegates installation tasks to the 'clawsec-suite' dependency without unauthorized file mutations or data exfiltration.

能力评估

✓ Purpose & Capability

Name/description, declared dependency on clawsec-suite, and required binaries (node, clawhub, openclaw) match the code and CLI behavior. The scripts call clawhub inspect/search and delegate to the clawsec-suite guarded installer as described, so the requested capabilities are appropriate for the stated purpose.

ℹ Instruction Scope

Runtime instructions and scripts stay within the stated scope: they run ClawHub inspect/search, compute heuristics, and optionally instruct a manual integration into clawsec-suite hooks. A caution: the enhanced installer delegates to the suite's guarded installer and streams process.env to it (no new env vars are read by the skill), so the ultimate install flow will run the original installer with the full environment—expected but worth noting.

✓ Install Mechanism

No external install/download is present in the skill bundle (instruction-only install). All code is provided in the package; there are no remote URLs or extract/install steps that would pull arbitrary code at install time.

ℹ Credentials

The skill declares no required secrets and only one optional env var (CLAWHUB_REPUTATION_THRESHOLD), which is proportional. Minor caveat: enhanced_guarded_install passes the parent process.env unchanged to the original guarded installer—this is functionally reasonable but means any environment-level secrets present will also be available to the delegated installer process.

✓ Persistence & Privilege

The skill does not request always:true or automatic mutation of other skills. The setup helper explicitly avoids rewriting other skills and the advisory-hook wiring is manual, which limits persistent/privileged changes.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install clawsec-clawhub-checker
安装完成后，直接呼叫该 Skill 的名称或使用 /clawsec-clawhub-checker 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.0.3

Release 0.0.3 via CI

v0.0.2

Release 0.0.2 via CI

v0.0.1

Release 0.0.1 via CI

元数据

Slug clawsec-clawhub-checker

版本 0.0.3

许可证 MIT-0

累计安装 7

当前安装数 7

历史版本数 3

常见问题