← 返回 Skills 市场
Skill Security Audit
作者
chensu1234
· GitHub ↗
· v1.0.0
· MIT-0
1400
总下载
0
收藏
11
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-security-audit-v2
功能描述
已安装 Skills 的安全审计工具。用于批量审计 Skills 的安全性，包括命令执行、网络访问、文件访问、数据泄露、依赖风险、提示词越权和触发条件检查。适用于用户提供 Skills 列表和文件内容时进行安全扫描、护栏审查、提示词越权审查或强化建议。
安全使用建议
This skill appears coherent and low-risk because it is instruction-only and asks you to supply the Skill files to be audited. Before using it: (1) only provide the files you intend to share—do not include secrets, API keys, or private tokens; (2) confirm how your agent runtime enforces file access (ensure the agent will not autonomously read system files or connectors); (3) prefer running the audit in an environment that isolates sensitive data; and (4) consider adding an explicit instruction to the skill to 'only inspect files attached to the user request' to reduce the chance of unintended file access.
功能分析
Type: OpenClaw Skill
Name: skill-security-audit-v2
Version: 1.0.0
The skill is a security auditing tool designed to guide an AI agent in reviewing other skills for vulnerabilities. The instructions in SKILL.md and references/review-checklist.md provide a structured framework for identifying risks such as arbitrary command execution, data exfiltration, and prompt injection, while offering safer code patterns for remediation. No malicious logic, data exfiltration, or obfuscation was found.
能力评估
Purpose & Capability
Name and description match the requested inputs and actions: the skill is designed to audit Skills and asks the user to provide a skills list and file contents. There are no unrelated environment variables, binaries, or install steps, so the declared requirements are proportionate to the stated purpose.
Instruction Scope
SKILL.md provides a clear checklist, categories, and an output template for auditing user-supplied Skill files (SKILL.md, scripts, dependencies, references). It explicitly includes safer patterns (limit to files provided by user, avoid connectors/secrets, require explicit consent for outbound transfers). However, the instructions do not explicitly forbid the agent from independently reading local system files or connectors — the safety relies on the operator/agent implementation and on the user providing only the files they want audited. Recommend explicitly requiring 'only analyze files provided in the request' to avoid overbroad file access.
Install Mechanism
No install spec and no code files — instruction-only skill. This minimizes disk footprint and eliminates risks from remote downloads or package installs.
Credentials
No environment variables, credentials, or config paths are requested. This is proportional to an audit-by-inspection tool. Reminder: users should avoid supplying secrets or credentials as part of the files they submit for audit.
Persistence & Privilege
always:false and no special privileges requested. The skill does not request permanent inclusion or modification of other skills or system-wide settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-security-audit-v2 - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-security-audit-v2触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of skill-security-audit, a tool for batch auditing the security of installed Skills.
- Supports detection of command execution, network access, file/system access, data leakage, dependency risks, prompt injection, and trigger condition issues.
- Provides structured security reports per Skill with severity ratings, risk evidence, and remediation suggestions.
- Includes auditing matrix and severity definitions to standardize risk evaluation.
- Output includes both detailed reports and an overall summary highlighting top risks and remediation priorities.
元数据
常见问题
Skill Security Audit 是什么？
已安装 Skills 的安全审计工具。用于批量审计 Skills 的安全性，包括命令执行、网络访问、文件访问、数据泄露、依赖风险、提示词越权和触发条件检查。适用于用户提供 Skills 列表和文件内容时进行安全扫描、护栏审查、提示词越权审查或强化建议。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1400 次。
如何安装 Skill Security Audit？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-security-audit-v2」即可一键安装，无需额外配置。
Skill Security Audit 是免费的吗？
是的，Skill Security Audit 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Skill Security Audit 支持哪些平台？
Skill Security Audit 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Security Audit？
由 chensu1234（@chensu1234）开发并维护，当前版本 v1.0.0。
推荐 Skills