← 返回 Skills 市场
259
总下载
1
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install skill-security-guide
功能描述
Security best practices guide for passing ClawHub security scans with "Benign" ratings. Use when creating or reviewing skills to ensure they meet security st...
安全使用建议
This guide appears coherent and safe to install, but before using or copying examples: (1) never paste real API keys or secrets into SKILL.md or examples, (2) when implementing the checklist, verify your code matches documentation and does not disable SSL or log secrets, (3) run your own static and dynamic checks on code you produce, and (4) be cautious when converting metadata — the recommended single-line JSON format is a documentation requirement, not a mechanism to hide secrets. If you plan to adapt examples into code, test locally and review any added dependencies or env-vars for necessity before publishing.
功能分析
Type: OpenClaw Skill
Name: skill-security-guide
Version: 1.0.1
This skill is a documentation-only security guide designed to help developers create skills that pass security scans. It provides best practices for metadata formatting, SSL verification, and secret handling, and includes benign shell commands (grep) for local verification. There is no executable code or evidence of malicious intent.
能力评估
Purpose & Capability
The skill is a documentation/guide. It declares no binaries, no env vars, and no install steps — which matches the stated purpose of teaching authors how to pass scans.
Instruction Scope
SKILL.md contains developer-facing best-practice checks and examples (grep commands, code snippets). It does not instruct an agent to read arbitrary files, exfiltrate data, contact unexpected endpoints, or access credentials.
Install Mechanism
No install spec and no code files. Being instruction-only minimizes disk writes and execution risk.
Credentials
The skill requests no environment variables or credentials. Example snippets reference env var names only to illustrate best practices and explicitly advise not to print secrets.
Persistence & Privilege
always is false and the skill does not request persistent or elevated privileges or modify other skills' configs. Normal autonomous invocation is allowed but not unusual for an instruction-only skill.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-security-guide - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-security-guide触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- Added "Issue 5: Documentation-Code Mismatch (Critical!)" section with real-world example and fixes.
- Included a new "Case Study: Fixing hunyuan-video and hunyuan-3d" detailing how to resolve security issues for actual skills.
- Expanded documentation on aligning response fields, status values, and code to match SKILL.md.
- No changes to metadata or overall structure; this is a documentation expansion for clearer, more actionable security guidance.
v1.0.0
Initial release of skill-security-guide.
- Provides comprehensive security best practices for creating or reviewing skills to pass ClawHub security scans with "Benign" ratings.
- Details correct JSON metadata formatting required in SKILL.md.
- Includes a security checklist covering metadata, code, and documentation requirements.
- Outlines common security issues and fixes, such as SSL verification and information leaks.
- Gives a complete example of a "Benign"-rated skill for reference.
- Explains how this guide complements skill-creator-2, focusing on security while the latter covers skill structure.
元数据
常见问题
Skill Security Guide 是什么？
Security best practices guide for passing ClawHub security scans with "Benign" ratings. Use when creating or reviewing skills to ensure they meet security st... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 259 次。
如何安装 Skill Security Guide？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-security-guide」即可一键安装，无需额外配置。
Skill Security Guide 是免费的吗？
是的，Skill Security Guide 完全免费（开源免费），可自由下载、安装和使用。
Skill Security Guide 支持哪些平台？
Skill Security Guide 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Security Guide？
由 Tony（@wszhhx）开发并维护，当前版本 v1.0.1。
推荐 Skills