← 返回 Skills 市场

Evez Skill Vetter

Name: Evez Skill Vetter
Author: evezart

作者 Evez666 · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ✓ 安全检测通过

总下载

当前安装

版本数

在 OpenClaw 中安装

/install evez-skill-vetter

功能描述

Security review for OpenClaw skills before installation. Use when evaluating third-party skills for safety, checking permission scope, detecting suspicious p...

使用说明 (SKILL.md)

Skill Vetter

Review third-party skills before installing them. Catch security risks early.

Quick Start

python3 scripts/vet.py --skill /path/to/skill
python3 scripts/vet.py --slug some-skill  # vet a ClawHub skill

What It Checks

Permission scope — Does the skill request exec, network, or file access?
Suspicious patterns — eval(), exec(), subprocess, fetch to unknown hosts, encoded strings
Data exfiltration — Sending data to external endpoints, logging secrets
Dependency risks — Known vulnerable packages, excessive dependencies
Code quality — Minified/obfuscated code, missing SKILL.md, oversized files
Secret exposure — Hardcoded API keys, tokens, passwords in source

Risk Score

Each check produces a risk score 0-100:

0-20: ✅ Safe — install freely
21-50: ⚠️ Caution — review findings before installing
51-75: 🚨 Risky — significant security concerns
76-100: ❌ Dangerous — do not install

Output

SKILL: some-skill
RISK: 35/100 (Caution)
FINDINGS:
  ⚠️ Uses subprocess.call() in scripts/run.sh:3
  ⚠️ Fetches from https://unknown-api.com in scripts/pull.py:12
  ✅ No hardcoded secrets found
  ✅ SKILL.md present and valid

安全使用建议

This skill is reasonable to use as a local, user-invoked scanner, but keep its scope narrow and do not rely on its score as a complete security decision. Be aware that the documented --slug workflow appears unimplemented and that the script may need the click Python package to run.

功能分析

Type: OpenClaw Skill Name: evez-skill-vetter Version: 1.0.0 The skill is a security auditing tool designed to perform static analysis on other OpenClaw skills. The primary script, scripts/vet.py, uses regex patterns to detect dangerous functions (e.g., eval, subprocess), hardcoded secrets (API keys, AWS tokens), and obfuscation techniques without executing the target code. The SKILL.md file provides clear documentation and lacks any prompt-injection attempts or deceptive instructions, and the code contains no evidence of data exfiltration or malicious intent.

能力标签

requires-sensitive-credentials

能力评估

ℹ Purpose & Capability

The stated purpose and included code are coherent: it locally scans a user-selected skill directory for risky text patterns. However, the documentation describes broader vetting such as dependency risk checks and a ClawHub slug workflow that the provided script only partially implements.

ℹ Instruction Scope

The instructions are user-invoked CLI examples, not automatic execution. The --skill path is user-controlled and scanned recursively, so users should keep it scoped to the skill they intend to review.

ℹ Install Mechanism

There is no install spec or remote installer, which is low risk. The script imports the external Python package click, but no dependency declaration is provided, so running it may require a separately installed dependency.

ℹ Credentials

Recursive local file reading is proportionate for a static skill vetter and the artifacts show no network transmission, credential use, or persistence. It can still inspect many local files if pointed at a broad directory.

✓ Persistence & Privilege

No background service, persistence mechanism, account privilege use, credential loading, or stored memory behavior is shown in the artifacts.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install evez-skill-vetter
安装完成后，直接呼叫该 Skill 的名称或使用 /evez-skill-vetter 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of evez-skill-vetter — security auditing tool for OpenClaw skills. - Performs static analysis to identify suspicious code patterns and permission requests. - Checks for data exfiltration risks, secret exposure, and dependency vulnerabilities. - Audits skill metadata, code quality, and permission scope before installation. - Assigns a risk score (0–100) with clear safety recommendations. - Provides detailed, actionable findings for each analyzed skill.

元数据

Slug evez-skill-vetter

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题