← 返回 Skills 市场
asaotomo

ZipCracker

作者 asaotomo · GitHub ↗ · v2.0.1 · MIT-0
cross-platform ⚠ suspicious
577
总下载
1
收藏
1
当前安装
7
版本数
在 OpenClaw 中安装
/install zipcracker
功能描述
CTF-oriented ZIP cracking and recovery with the bundled ZipCracker engine. Use when Codex or OpenClaw needs to analyze or recover an encrypted ZIP in authori...
安全使用建议
This skill appears to do what it says (ZIP CTF cracking) and includes the code for that work, but take these precautions before using it: 1) Use only on archives you own or are authorized to test. 2) Run it in an isolated workspace (not your home directory) because it will write extracted files and temp files to the current working directory. 3) The tool may fetch bkcrack/other binaries and call subprocesses to run them — if you have network or execution policies, review and restrict those before allowing automatic installs. 4) By default the wrapper disables automatic installs, but enabling --allow-install-prompts or related env flags can cause external downloads; only enable them knowingly. 5) If you need to be extra cautious, review the included scripts (zipcracker_core.py and wrapper) locally and run in a sandbox or VM.
功能分析
Type: OpenClaw Skill Name: zipcracker Version: 2.0.1 The zipcracker skill bundle provides advanced ZIP recovery and cracking capabilities, including dictionary, mask, and known-plaintext attacks (KPA). It is classified as suspicious primarily due to high-risk automated environment setup routines in 'scripts/zipcracker_core.py'. Specifically, the script contains logic to automatically download and execute binaries from GitHub (kimci86/bkcrack) and can generate and execute shell commands to install system-level dependencies using 'sudo' (e.g., 'apt install', 'dnf install'). While these features are intended for legitimate dependency management in CTF contexts and are gated by user prompts, the ability to fetch remote payloads and execute privileged shell commands represents a significant security risk and potential for abuse.
能力评估
Purpose & Capability
Name/description align with included code and bundled password list. The files and CLI wrapper implement ZIP profiling, dictionary/mask/KPA workflows and integrations (bkcrack, pyzipper) that are expected for this functionality.
Instruction Scope
SKILL.md stays on-topic: it tells the agent to gather ZIP-specific inputs, run profile mode, and run the bundled wrapper with explicit flags. It does not instruct arbitrary file-system or credential harvesting. It does instruct keeping the CWD as the project directory (which affects where outputs are written) — this is relevant operationally but not out-of-scope.
Install Mechanism
There is no install spec in the registry (skill ships as code), but the core script can make network calls at runtime (GitHub API, downloads for bkcrack/MSVC redistributables, optional pip mirror). Those runtime downloads are coherent with needing bkcrack/pyzipper but constitute higher-risk behavior than pure offline scripts. The wrapper defaults to disabling automatic interactive installs unless explicitly allowed.
Credentials
The skill declares no required env vars or credentials. It defines option env names (e.g., ZIPCRACKER_AUTO_INSTALL_BKCRACK) for runtime behavior, which is reasonable. No unrelated secrets or cloud credentials are requested.
Persistence & Privilege
always:false and normal autonomous invocation are set. The skill writes temp files and extracted files (default OUT_DIR 'unzipped_files') into the working directory and may create other temp artifacts; it also spawns subprocesses (bkcrack, pip, pyzipper usage). This is expected for a cracking tool but users should be aware of file writes and subprocess execution.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install zipcracker
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /zipcracker 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v2.0.1
**Summary:** Major refactor with new wrapper, expanded documentation, improved workflows, and added attack references. - Added `scripts/openclaw_zipcracker.py` as the preferred engine wrapper, superseding raw script calls. - Introduced extensive reference documentation and attack playbooks under `/references`. - Reworked documentation for clearer workflow guidance, usage scenarios, and decision trees. - Detailed new command-line flags and attack strategies, including CRC32, mask, template KPA, and `bkcrack` integrations. - Deprecated old main scripts and flattened legacy usage in favor of the OpenClaw skill wrapper. - Expanded multilingual trigger phrases and CTF challenge coverage.
v2.0.0
🌟 ZipCracker V2.0.0 (Agent-Native Edition) Author: asaotomo (Hx0 Team) This major release transforms ZipCracker from a standard CLI tool into a fully autonomous, Agent-ready weapon natively integrated with the OpenClaw ecosystem. 🤖 AI Agent Integration [New] Quiet/Agent Mode (-q): Suppresses real-time progress bars and terminal noise to prevent LLM token overflow and support CI/CD pipelines. [New] Tactical SKILL.md: Empowers OpenClaw Agents to autonomously request OSINT clues from users and dynamically generate custom social engineering dictionaries on the fly. [Changed] Zero-Interaction Execution: Completely removed all blocking input(y/n) prompts to ensure seamless, headless automation. ⚡ Engine Enhancements [Enhanced] Auto CRC32 Collision: Instantly and silently cracks small files (<= 6 bytes) without halting the cracking pipeline. [New] AES Auto-Healing: Dynamically detects AES encryption and missing pyzipper dependencies, automatically executing pip install in the background to prevent script failure. 📝 Structure & Docs [Changed] Unified Naming: Simplified the core script name to ZipCracker.py. [Updated] Global README: Added OpenClaw integration notes and detailed mask attack documentation.
v1.1.4
**Changelog for zipcracker v1.1.4** - Migrated documentation format: replaced detailed Chinese SKILL.md with an English, OpenClaw-standard YAML/Markdown file. - Updated all usage examples and instructions to reference ZipCracker.py (renaming from zipcracker.py). - Removed legacy install, registration, and extra documentation files (install.sh, requirements.txt, clawhub.json, QUICKSTART.md). - Clarified attack modes, usage patterns, and response expectations for both users and assistants.## Description Hi OpenClaw Team! 👋 This PR introduces **ZipCracker**, a powerful, multi-threaded ZIP password cracking tool developed by the Hx0 Team (Author: asaotomo). By adding this skill, OpenClaw Agents will now have the native ability to automatically analyze, repair, and crack password-protected `.zip` files through natural language commands—making it an incredibly useful tool for security researchers, CTF players, and everyday users who forgot their archive passwords. ## Key Features * **Auto-Repair Pseudo-Encryption:** Automatically detects and fixes pseudo-encrypted ZIP files without needing a password. * **Smart Dictionary Attacks:** Supports custom dictionary files, directories, and falls back to a built-in 1-6 digit numeric generator. * **Advanced Mask Attacks:** Allows users to specify password patterns (e.g., `?d?d?d?l` for 3 digits + 1 lowercase) to drastically reduce cracking time. * **CRC32 Collision:** Automatically attempts hash collisions for extremely small files (< 6 bytes) hidden inside the archive. * **AES Support:** Fully supports modern AES-encrypted ZIPs (if `pyzipper` is installed). ## 🤖 Optimizations for OpenClaw Agent To ensure this tool plays perfectly with LLM context windows, I have specifically added a **Quiet/Agent Mode (`-q` flag)**. * When the Agent calls the script, it will suppress the real-time progress bar (`\r` loops) and interactive `(y/n)` prompts. * It outputs strictly what the Agent needs to read: the final success status and the cracked password, preventing any token overflow or context degradation. ## Example Prompts for Testing Once loaded, you can test the Agent with prompts like: > *"I have an encrypted file named `flag.zip`. The password is exactly 4 digits. Please use ZipCracker to unlock it for me."* > *"Agent, use a mask attack on `secret.zip`. The password starts with 'admin' followed by 3 numbers."* ## Checklist - [x] Tested locally with OpenClaw. - [x] Included `SKILL.md` with clear instructions for the Agent. - [x] Updated `README.md` to reflect Agent usage (`-q` flag). - [x] Code does not contain any malicious payloads. Looking forward to seeing this in the official ClawHub! Let me know if any adjustments are needed.
v1.1.3
## ZipCracker Skill v1.1.3 - No file changes detected in this release. - Functionality, documentation, and behavior remain the same as the previous version (v1.1.1).
v1.1.2
- 移除 _meta.json 文件,精简了技能元数据文件结构 - 其他功能与文档保持不变
v1.1.1
v1.1.1 重点:适配 OpenClaw Agent、支持标准 JSON 输出。 - 新增 `--agent` 参数,专为 OpenClaw Agent 设计,支持静默后台执行与结构化 JSON 结果输出 - 移除命令行阻塞操作,实现无交互自动化 - 优化安装注册流程,完善技能元数据文件 - 文档更新,新增 OpenClaw 智能助手应用指引
v1.0.0
ZipCracker Skill 1.0.0 - 初始版本发布,基于 Hx0 战队 ZipCracker v1.0 项目适配 - 集成 OpenClaw Skill 平台 - 支持伪加密检测修复、字典攻击、CRC32 碰撞、掩码攻击和 AES 加密破解 - 增强多线程性能,自动智能线程调整 - 优化用户交互和字典管理
元数据
Slug zipcracker
版本 2.0.1
许可证 MIT-0
累计安装 1
当前安装数 1
历史版本数 7
常见问题

ZipCracker 是什么?

CTF-oriented ZIP cracking and recovery with the bundled ZipCracker engine. Use when Codex or OpenClaw needs to analyze or recover an encrypted ZIP in authori... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 577 次。

如何安装 ZipCracker?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install zipcracker」即可一键安装,无需额外配置。

ZipCracker 是免费的吗?

是的,ZipCracker 完全免费,采用 MIT-0 许可证,可自由下载、安装和使用。

ZipCracker 支持哪些平台?

ZipCracker 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 ZipCracker?

由 asaotomo(@asaotomo)开发并维护,当前版本 v2.0.1。

💬 留言讨论