← 返回 Skills 市场
158
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install osv-ui
功能描述
Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human r...
安全使用建议
This skill appears to do what it claims: run osv-ui via npx, show a dashboard, and propose fixes. Before using it, ensure you: (1) have Node/npm and npx available or adjust the instructions; (2) understand that npx will fetch and execute code from the npm registry — review or pin the osv-ui package source/version if you require higher assurance; (3) run scans in an isolated environment (container/VM) if you're worried about executing remote code or exposing local registry credentials; (4) verify the skill asks for explicit confirmation before it runs npm install (it does in SKILL.md); and (5) check for sensitive tokens in your .npmrc or environment that npm/npx could use. If you want lower risk, install osv-ui from a vetted release locally and run the commands yourself rather than using npx to fetch on-demand.
功能分析
Type: OpenClaw Skill
Name: osv-ui
Version: 1.0.1
The osv-ui skill is a security auditing tool designed to scan projects for CVEs using the osv-ui package via npx. The instructions in SKILL.md outline a transparent workflow involving scanning, generating reports, and applying fixes only after explicit user confirmation, with no evidence of data exfiltration, obfuscation, or malicious intent.
能力评估
Purpose & Capability
The skill is a CVE/audit helper and its SKILL.md shows exactly the commands you'd expect (npx osv-ui, parse JSON, show fixes). However the metadata declares no required binaries while the instructions assume node/npm/npx are available; that's a minor inconsistency but not malicious.
Instruction Scope
Instructions stay on-task: scan projects, export JSON, open a dashboard, show fix commands, and re-scan after applying fixes. The skill explicitly requires user confirmation before applying changes. It does not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
There is no install spec (instruction-only). Runtime use relies on npx which will fetch and execute code from the npm registry if not installed locally — this is normal for this use case but carries the usual risk of executing remote package code.
Credentials
The skill requests no environment variables or credentials (appropriate). Be aware that running npm/npx/npm install can implicitly use local npm config (.npmrc) or registry auth tokens present on the host; the SKILL.md does not acknowledge that, so credentials could be used by those commands even though not requested.
Persistence & Privilege
The skill is not always-enabled, does not request persistent privileges, and does not modify other skills or global agent configuration. It is user-invocable and can be run autonomously by the agent (default), which is normal.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install osv-ui - 安装完成后，直接呼叫该 Skill 的名称或使用
/osv-ui触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- SKILL.md substantially rewritten for conciseness and clarity.
- "How it works" section condensed; lengthy step-by-step detail removed.
- Instructions and workflow streamlined into 5 main steps.
- Activation triggers, key commands, and usage notes presented in a simpler format.
- Quick reference and notes retained with clearer examples.
- No code or feature changes; documentation-only update.
v1.0.0
Initial release of osv-ui security auditing skill.
- Enables scanning for CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui.
- Launches an interactive visual dashboard for human review of scan results before any fixes.
- Automates detection of manifest files and guides users through the audit, review, and remediation workflow.
- Only applies fixes after explicit user confirmation, showing all commands and changes in advance.
- Runs all analysis locally for user privacy; no code is uploaded.
- Supports integration with projects using Dependabot, Snyk, or other popular security tools.
元数据
常见问题
CVE Audit Skill 是什么？
Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human r... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 158 次。
如何安装 CVE Audit Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install osv-ui」即可一键安装，无需额外配置。
CVE Audit Skill 是免费的吗？
是的，CVE Audit Skill 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
CVE Audit Skill 支持哪些平台？
CVE Audit Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 CVE Audit Skill？
由 toan203（@toan203）开发并维护，当前版本 v1.0.1。
推荐 Skills