Skill Security Guard

Skill 安全扫描器 - 检测第三方技能的恶意代码、信息泄露等安全风险，保护你的 AI 助手安全！

This skill appears to be a legitimate local security scanner. Before running it: 1) don’t point it at system root or sensitive directories (e.g., /, your home, or cloud creds directories) while running as an elevated user—it will read files and could report sensitive content; 2) expect active network checks if you allow network scanning or if the scanner is configured to validate discovered URLs (these can contact remote hosts); 3) review scanner output and the rules/whitelist (rules/safe_domains.json) and avoid running it with root unless necessary; 4) verify you trust the skill source/author before giving it access to private repositories or directories. If you want extra assurance, inspect scanner.py for any data exfiltration paths (e.g., code that posts findings to remote servers) — none were evident in the provided files, but the full scanner.py and remaining truncated files should be reviewed if you need maximum assurance.

Type: OpenClaw Skill Name: skill-security-guard-publish Version: 1.0.2 The skill bundle is a security auditing tool designed to scan other OpenClaw skills for malicious code, hardcoded secrets, and risky configurations. It utilizes static analysis (AST and regex) in scanner.py and various checker modules (code_checker.py, sensitive_checker.py) to identify patterns like RCE, data exfiltration, and unauthorized file access. While the bundle includes active system and network probing capabilities in network_checker.py (e.g., port scanning and firewall status checks), these behaviors are consistent with its stated purpose as a 'Security Guard' and show no evidence of malicious intent, unauthorized data exfiltration, or prompt injection.