← 返回 Skills 市场
4835
总下载
4
收藏
58
当前安装
2
版本数
在 OpenClaw 中安装
/install skill-security-auditor
功能描述
Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns.
安全使用建议
Install through the ClawHub CLI when possible. Use the scanner as one review aid, not proof that another skill is safe. Avoid raw curl installation or remote pattern updates unless you trust the source and can verify the files or pin a known release.
功能分析
Type: OpenClaw Skill
Name: skill-security-auditor
Version: 1.0.1
The 'skill-security-auditor' skill is designed to analyze other OpenClaw skills for malicious patterns. Its core script, `analyze-skill.sh`, uses `grep` with patterns defined in `patterns/malicious-patterns.json` to identify threats. The skill makes legitimate network calls to `clawhub.ai` to fetch skills for analysis and to `openclaw-security.github.io` for threat intelligence updates, which are necessary for its stated purpose. There is no evidence of intentional harmful behavior, data exfiltration, persistence, or prompt injection against the agent within its own code or documentation (`SKILL.md`, `README.md`). The patterns it detects (e.g., `curl | bash`, known C2 IPs) are correctly used for detection, not execution by the skill itself.
能力评估
Purpose & Capability
The artifacts coherently implement a Bash-based, pattern-matching auditor for SKILL.md files using a local JSON pattern database; its results are advisory heuristics, not a guarantee of safety.
Instruction Scope
Runtime use is user-directed through local file analysis or an explicit skill slug fetch, and the artifacts do not show automatic scanning, installation blocking, hidden execution, destructive behavior, or credential harvesting.
Install Mechanism
The primary install path is the ClawHub CLI, while the README also documents optional raw curl downloads and an optional remote threat-intelligence update; these are disclosed but should be treated as supply-chain trust decisions.
Credentials
The required tools bash, curl, jq, and grep are proportionate for fetching skill metadata, parsing JSON, and scanning text patterns; network access is limited to documented user-requested fetches and optional updates.
Persistence & Privilege
The only persistence described is an optional shell alias and user-managed local pattern-file updates; there is no evidence of background services, privilege escalation, auth store access, or hidden persistence.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-security-auditor - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-security-auditor触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- Added a command-line Bash script (analyze-skill.sh) for local security audits of ClawHub skills.
- Updated documentation to emphasize CLI usage and step-by-step instructions.
- Clearly outlined the scope: manual invocation, no automatic scanning or VirusTotal API integration.
- Improved description of detection heuristics and audit workflow.
- Detailed how to analyze skills by slug or local file for risk assessment.
v1.0.0
Initial release of skill-security-auditor: pre-installation security auditing for ClawHub skills.
- Analyzes SKILL.md files, dependencies, and code for malicious patterns and credential leaks.
- Detects suspicious prerequisites, C2 infrastructure indicators, and known campaign signatures (e.g., ClawHavoc).
- Assigns a risk score (0-100) and generates detailed audit reports with recommendations.
- Validates SKILL.md structure, author information, and dependency origins.
- Integrates manual VirusTotal checking and provides usage examples for local and ClawHub-based audits.
元数据
常见问题
Skill Security Auditor 是什么？
Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 4835 次。
如何安装 Skill Security Auditor？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-security-auditor」即可一键安装，无需额外配置。
Skill Security Auditor 是免费的吗？
是的，Skill Security Auditor 完全免费（开源免费），可自由下载、安装和使用。
Skill Security Auditor 支持哪些平台？
Skill Security Auditor 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Security Auditor？
由 AM（@akhmittra）开发并维护，当前版本 v1.0.1。
推荐 Skills