← 返回 Skills 市场
398
总下载
0
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install skill-security-scanner-clean
功能描述
Security scanner for OpenClaw skills. Use when installing, updating, or auditing skills to detect malicious backdoors, suspicious code patterns, data exfiltr...
安全使用建议
This skill appears to do what it says: a local static scanner for OpenClaw skills. Before installing or relying on it, consider the following: 1) Source provenance: the package has no homepage and the owner is unknown — review the code yourself or prefer a scanner from a trusted, verifiable source. 2) False positives: some detection rules are broad (flags for common hosts, IPs, or large/minified files); treat 'WARNING'/'REVIEW' results as prompts for manual inspection rather than automatic rejection. 3) Artifacts: the install guard saves a .security_scan_report.json inside the scanned skill directory — ensure you are comfortable with that artifact being created. 4) Safe testing: run the scanner on known-good and known-bad samples in an isolated environment to validate its behavior and tune expectations (or strict mode). 5) If you plan to integrate this into automation, review the scoring/verdict thresholds in references/rules-reference.md and consider whitelisting legitimate patterns to reduce noise.
功能分析
Type: OpenClaw Skill
Name: skill-security-scanner-clean
Version: 1.0.0
This skill bundle is a security scanner designed to detect malicious and suspicious patterns in other OpenClaw skills. The code (`scripts/install_guard.py`, `scripts/security_scanner.py`) itself does not exhibit any malicious behavior. It performs static analysis by reading skill files, identifying dangerous functions, network calls, file operations, and environment variable access patterns. The `SKILL.md` provides clear documentation for the scanner's purpose and usage, without any prompt injection attempts against the AI agent. File operations are limited to reading scanned files and writing a security report within the scanned skill's directory. No evidence of data exfiltration, unauthorized execution, persistence, or obfuscation within the scanner's own code was found.
能力评估
Purpose & Capability
Name/description match the included files: SKILL.md, scripts/security_scanner.py, and an install guard. The scanner implements pattern-based detection for eval/exec, network calls, file ops, env access, obfuscation, etc., which is appropriate for a security scanner. No unrelated credentials, binaries, or external services are requested.
Instruction Scope
SKILL.md and scripts instruct the agent/human to run the scanner against a skill directory and to incorporate it into install workflows. That is within scope. Notes: (1) Detection rules explicitly flag some legitimate hosting services and IP literals (e.g., gist.github.com, drive.google.com, dropbox.com, raw IPs), which is an overbroad heuristic that will cause false positives in otherwise legitimate skills. (2) Some regexes (e.g., obfuscation patterns) are coarse and may trigger on large/minified legitimate files. (3) The install_guard will save a .security_scan_report.json into the scanned skill directory (which is useful but adds an artifact to the scanned path).
Install Mechanism
There is no install spec; this is effectively an instruction + code bundle. No remote downloads, package managers, or archive extractions are performed by the skill itself. Code files are present in the package and executed locally; that is expected for this tool.
Credentials
The skill declares no required environment variables, no credentials, and no privileged config paths. The scanner code does look for environment-accessing patterns in scanned code (appropriate for its purpose) but does not itself attempt to read the host environment or request secrets.
Persistence & Privilege
The skill does not request permanent 'always' presence and uses normal model invocation. It will write a .security_scan_report.json into the scanned skill directory when run via the install_guard, which is reasonable for an audit tool but worth knowing (artifact persistence). It does not modify other skills' configs or system-wide settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skill-security-scanner-clean - 安装完成后，直接呼叫该 Skill 的名称或使用
/skill-security-scanner-clean触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of skill-security-scanner:
- Introduces a static security scanner for OpenClaw skills detecting backdoors, suspicious code, data exfiltration, and vulnerabilities.
- Analyzes Python, JavaScript, and Shell code for code execution threats, network requests, file operations, credential access, obfuscation, and more.
- Assigns a security score and clear verdict (PASS, REVIEW, WARNING, REJECT) with actionable recommendations.
- Provides CLI usage modes including strict scanning and report generation in JSON or Markdown.
- Details detection rules, integrating common patterns and threat signatures for comprehensive auditing.
- Includes best practices, workflow guidance, and integration examples to ensure safe skill installation and updates.
元数据
常见问题
skill-security-scanner-clean 是什么？
Security scanner for OpenClaw skills. Use when installing, updating, or auditing skills to detect malicious backdoors, suspicious code patterns, data exfiltr... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 398 次。
如何安装 skill-security-scanner-clean？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skill-security-scanner-clean」即可一键安装，无需额外配置。
skill-security-scanner-clean 是免费的吗？
是的，skill-security-scanner-clean 完全免费（开源免费），可自由下载、安装和使用。
skill-security-scanner-clean 支持哪些平台？
skill-security-scanner-clean 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 skill-security-scanner-clean？
由 RUI LIU（@cookiemikeliu）开发并维护，当前版本 v1.0.0。
推荐 Skills