Skill Security Vet

技能安全審核 - 整合本地掃描 + VirusTotal 雲端威脅情報

This skill can scan installed skills and query VirusTotal, which matches its description — but it also contains a full-disk scanning mode and can automatically quarantine or delete files. Before installing or running it: 1) Inspect the code yourself or run it in a sandbox or VM first. 2) Disable automatic actions (autoQuarantine/autoRemove/autoScanOnStartup) in the config before running scans. 3) Do not provide your VirusTotal API key until you confirm where it is stored (the code writes plain JSON to ~/.opencode/config). 4) Backup ~/.opencode/skill (and important data) so you can recover if the tool quarantines or removes files. 5) If you only want skill-level checks, run the tool with explicit arguments (e.g., scan for specific skills) and avoid 'local' or 'full' modes. If you are not comfortable reviewing the code or running it in an isolated environment, treat this skill as high-risk.

Type: OpenClaw Skill Name: skill-security-vet Version: 2.0.0 The skill-security-vet bundle is a security auditing tool that performs local and cloud-based (VirusTotal) threat detection. While its stated purpose is defensive, it contains high-risk capabilities including broad filesystem scanning of system drives ('/' or 'C:\') in vet.ts, and the ability to automatically 'quarantine' (move) or delete files and directories in both vet.ts and startup-scan.ts. The inclusion of a startup script that automatically scans and potentially disables other skills, combined with the invasive nature of the full system scan, makes this bundle suspicious despite its documented utility. It communicates with virustotal.com for file reputation checks.