← 返回 Skills 市场
416
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install skill-safety-verifier
功能描述
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
安全使用建议
This tool appears to implement the vetting functions it advertises, but do not run it on sensitive networks or with privileged access until you address the TLS issue. Ask the author why SSL verification is disabled (and prefer a version that keeps certificate verification enabled). Before installing or using: 1) Inspect analyzer.py (the fetch_advisories code) and patch it to enable certificate verification (remove CERT_NONE). 2) Run the analyzer in an isolated environment/container with limited network access. 3) Consider providing a GitHub token for authenticated advisory queries. 4) Review any output the analyzer produces (it writes a cache to ~/.cache/skill-safety/). If you are not comfortable editing code, avoid installing or only run on isolated test hosts.
功能分析
Type: OpenClaw Skill
Name: skill-safety-verifier
Version: 0.1.1
The skill 'skill-safety-verifier' is designed to detect security risks in other skills, which is a benign purpose. However, the `analyzer.py` file contains a critical vulnerability: it disables SSL certificate verification (`ctx.verify_mode = ssl.CERT_NONE`) when fetching vulnerability advisories from `https://api.github.com/advisories`. This makes the skill susceptible to Man-in-the-Middle (MITM) attacks, allowing an attacker to feed false or malicious vulnerability data to the verifier, thereby compromising its integrity. While this is a vulnerability in the skill's own security implementation rather than an act of intentional malice, it is a significant flaw in a security tool, classifying it as 'suspicious'.
能力评估
Purpose & Capability
Name/description align with the code and files: analyzer.py implements code-pattern scanning, dependency vulnerability checks against GitHub Advisory API, permission analysis and a risk scoring renderer. The presence of setup.py, CLI entry point, and documentation is consistent with a local analysis tool.
Instruction Scope
SKILL.md/README describe cloning a target skill and scanning its files and dependencies, which matches analyzer.py's scanning behavior. However there is a notable contradiction: README claims SSL verification is used by default, while analyzer.py explicitly disables SSL certificate verification (ssl.CERT_NONE) when calling the GitHub Advisory API. That weakens the security guarantees of a tool whose purpose is vetting security.
Install Mechanism
Registry has no install spec, but the package includes setup.py and instructions to pip install or wget individual files. The install approach uses standard pip/setuptools and a small requirements.txt (requests). No high-risk download-from-unknown-host patterns are present in the manifest; however README suggests direct wget from raw.githubusercontent.com which is common but should be used carefully.
Credentials
The skill declares no required environment variables or elevated credentials. It writes cache to ~/.cache/skill-safety/ (expected for advisories cache). The tool scans repository files (including SKILL.md, package.json) which is necessary for its purpose and does not request unrelated secrets.
Persistence & Privilege
No always:true, no special OS-level privileges requested. Installing via pip would create a console script and a cache directory — standard for a CLI tool. It does not attempt to modify other skills' configs or request permanent platform privileges.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-safety-verifier - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-safety-verifier触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.1
## v0.1.1 Changelog
- Updated documentation in `README.md` for clarity and detail.
- No code or functional changes introduced in this version.
- Content was added and/or reorganized to improve explanation of assessment criteria, risk scoring, workflow, and usage examples.
v0.1.0
Skill Safety Verifier — initial release.
- Provides security-first vetting for AI agent skills before installation.
- Scans for red flags, permission scope, suspicious code patterns, and known vulnerabilities.
- Calculates a unified risk score across network, code quality, and permissions.
- Classifies risk into Safe, Low, Medium, or High with clear recommendations.
- Integrates with GitHub Advisory API for real-time vulnerability data.
- Outputs easy-to-read risk radar and summary to guide user decisions.
元数据
常见问题
Skill Safety Verifier 是什么？
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 416 次。
如何安装 Skill Safety Verifier？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-safety-verifier」即可一键安装，无需额外配置。
Skill Safety Verifier 是免费的吗？
是的，Skill Safety Verifier 完全免费（开源免费），可自由下载、安装和使用。
Skill Safety Verifier 支持哪些平台？
Skill Safety Verifier 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Safety Verifier？
由 ttttstc（@ttttstc）开发并维护，当前版本 v0.1.1。
推荐 Skills