← 返回 Skills 市场
178316
总下载
38
收藏
18
当前安装
2
版本数
在 OpenClaw 中安装
/install skillscan
功能描述
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On...
安全使用建议
Install only if you trust the publisher and skillscan.tokauth.com with the contents of skills you scan. Avoid scanning private skills that may contain secrets, proprietary prompts, or internal code unless that upload is acceptable. Treat it as an advisory scanner unless your environment separately enforces its exit codes, and review or disable the self-update path where possible.
能力评估
Purpose & Capability
The stated purpose of scanning skills is coherent with the Python scanner, cloud cache lookup, upload, polling, and risk reporting. The concern is that the skill presents itself as a mandatory no-exceptions gate, while installed high-risk skills are only offered for deletion and real blocking depends on external callers honoring exit codes.
Instruction Scope
Activation instructions are broad enough to cover installs, loads, safety questions, pasted SKILL.md content, and unknown skill mentions. That scope can cause a network-backed scan flow to run in more situations than a user may expect.
Install Mechanism
The package installs a runnable Python script and documents daily automatic update checks. The code can download an update manifest and overwrite files in its own skill directory with only manifest-provided hash checking, not an embedded signature or clear approval step.
Credentials
The scanner enumerates many local agent skill directories, zips skill contents for upload on cache misses, contacts skillscan.tokauth.com, and sends a persistent X-Client-Info header. Cloud scanning is purpose-aligned, but the data exposure and host fingerprinting are broad and under-disclosed.
Persistence & Privilege
The scanner writes hidden state files for first-run completion, update checks, and client identity, and it can delete flagged skills only after user confirmation. The persistent client identity and self-update behavior are the main privilege and persistence concerns.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install skillscan - 安装完成后，直接呼叫该 Skill 的名称或使用
/skillscan触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.1.6
- Major cleanup: The readme documentation was removed.
- Simplified "First Load" process in SKILL.md by removing the requirement to write Skill Security rules to SOUL.md.
- Uninstall instructions regarding SOUL.md cleanup were dropped from the SKILL.md.
- Updated metadata version to 1.1.6.
v1.0.0
SkillScan v1.1.5 introduces a strict security gate for all skill installations and updates.
- Every new skill must pass a security scan before being used. HIGH/CRITICAL risk skills are blocked with no exceptions.
- Scan triggers on any install, load, add, evaluation, or safety-related request.
- On first use, writes a Skill Security rule to SOUL.md and scans all existing skills.
- Removes the Skill Security section from SOUL.md on uninstall.
- Provides command-line and API options for scanning, with clear exit codes and user instructions.
- Supports auto-update and can use a custom update source via environment variable.
元数据
常见问题
SkillScan 是什么？
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 178316 次。
如何安装 SkillScan？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install skillscan」即可一键安装，无需额外配置。
SkillScan 是免费的吗？
是的，SkillScan 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
SkillScan 支持哪些平台？
SkillScan 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 SkillScan？
由 tokauthai（@tokauthai）开发并维护，当前版本 v1.1.6。
推荐 Skills