敏感内容扫描器

专业的敏感内容扫描器，支持 PII 检测（身份证/手机号/银行卡/邮箱/IP）、敏感词检测、置信度评分、多格式报告生成。适用于文档审查、安全审计、内容合规检查、隐私保护等场景。

This skill appears to implement what it claims (PII and keyword scanning with local report generation), but take these precautions before installing or running it: - Inspect the full scripts: review the remainder of scripts/scan_sensitive.py to confirm there are no network calls (requests, urllib, sockets) or unexpected subprocess calls that could exfiltrate data. The preview is truncated — full-file review is needed to verify the 'no upload' claim. - Run in a sandbox: until you confirm no network activity, run the scanner on non-sensitive test files inside an isolated environment (air-gapped VM or container). - Confirm dependencies: the script uses third-party Python packages (Crypto/pycryptodome, and likely python-docx/openpyxl etc.). Determine required packages and versions before installing; prefer installing from known package mirrors and pin versions. - Validate encrypted-dictionary behavior: the script derives a fixed password from embedded code to decrypt .enc dictionaries. Understand this mechanism and ensure encrypted dicts come from trusted sources; otherwise malicious dictionaries could be loaded. - Check report output and storage: reports are written to report.html in working directory — verify where it will be saved and ensure it doesn't expose sensitive content to other users or services. - If you need high assurance, ask the publisher for: dependency list, full source file(s), and an explicit statement that no telemetry or network I/O is performed; if publisher cannot provide these, treat the package as untrusted.

Type: OpenClaw Skill Name: sensitive-content-scanner Version: 3.2.0 The skill is a functional utility designed to scan documents for PII (Personally Identifiable Information) and sensitive keywords. The core logic in `scripts/scan_sensitive.py` uses regex and weighted dictionaries to identify sensitive data in various file formats (Office docs and plain text) and generates local reports in HTML, Markdown, or JSON. While the script includes a mechanism to load encrypted dictionaries using a hardcoded password derivation seed (a weak cryptographic practice), there is no evidence of malicious intent, data exfiltration, or unauthorized command execution. The behavior is fully aligned with the stated purpose in `SKILL.md`.