YiDunAppDefense

易盾应用加固 - AI Agent Skill for multi-platform app protection

This skill appears to be what it claims: a wrapper that downloads and runs the official YiDun protection tool. Before installing/using it: 1) Confirm you trust the source (clienttool.dun.163.com is NetEase YiDun but validate it against vendor documentation). 2) Prefer to manually verify the downloaded archive (ask vendor for a checksum/signature); the included setup script does not perform a cryptographic integrity check. 3) Be aware the skill will store your AppKey and optionally keystore paths/passwords in ~/.yidun-defense/config.ini (the script sets 600 permissions) — avoid committing that file to version control and consider not storing plaintext keystore passwords. 4) Logs are written to /tmp and ~/.yidun-defense/Log/ and may contain sensitive info (costs, server responses); clean or secure logs if needed. 5) Run first in an isolated environment (CI runner or VM) if you want to observe network activity and what the downloaded JAR does. 6) If you depend on supply-chain integrity, request vendor-signed checksums or signatures for NHPProtect.jar before automating the download.

Type: OpenClaw Skill Name: yidun-app-defense Version: 1.0.1 The skill bundle provides a legitimate integration for NetEase YiDun's application shielding service, supporting Android, iOS, and HarmonyOS. The scripts (setup.sh, configure.sh, and defense-smart.sh) are well-structured and include security-conscious features such as Zip Slip protection during extraction and safe configuration handling using awk. All external network activity is directed to official NetEase domains (163.com) for downloading the necessary Java-based protection tools, and the behavior is entirely consistent with the stated purpose of providing app security hardening.