OpenClaw

skill-scanner

Scan OpenBot/Clawdbot skills for security vulnerabilities, malicious code, and suspicious patterns before installing them. Use when a user wants to audit a skill, check if a ClawHub skill is safe, scan for credential exfiltration, detect prompt injection, or review skill security. Triggers on security audit, skill safety check, malware scan, or trust verification.

hugosbl0 来源安装数☆ 0 仓库 Stars

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install hugosbl/ai-skill-scanner

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

Skill Security Scanner

Scan skills for malicious patterns before installation. Detects credential exfiltration, suspicious network calls, obfuscated code, prompt injection, and other red flags.

Quick Start

# Scan a local skill folder
python3 scripts/scan.py /path/to/skill

# Verbose output (show matched lines)
python3 scripts/scan.py /path/to/skill --verbose

# JSON output (for automation)
python3 scripts/scan.py /path/to/skill --json

Workflow: Scan Before Install

Download or locate the skill folder
Run python3 scripts/scan.py <skill-path> --verbose
Review findings by severity (CRITICAL/HIGH = do not install)
Report results to user with recommendation

Score Interpretation

Score	Meaning	Recommendation
CLEAN	No issues found	Safe to install
INFO	Minor notes only	Safe to install
REVIEW	Medium-severity findings	Review manually before installing
SUSPICIOUS	High-severity findings	Do NOT install without thorough manual review
DANGEROUS	Critical findings detected	Do NOT install — likely malicious

Exit Codes

0 = CLEAN/INFO
1 = REVIEW
2 = SUSPICIOUS
3 = DANGEROUS

Rules Reference

See references/rules.md for full list of detection rules, severity levels, and whitelisted domains.

Limitations

Pattern-based detection — cannot catch all obfuscation techniques
No runtime analysis — only static scanning
False positives possible for legitimate tools that access network/files
Always combine with manual review for HIGH/MEDIUM findings

来源信息

Source: github
Repository: openclaw/skills
Path: skills/hugosbl/ai-skill-scanner
Version: —
Commit: 2c8207af0663eec459c0003080e6c832c6f75cac
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# Skill Security Scanner

Scan skills for malicious patterns before installation. Detects credential exfiltration, suspicious network calls, obfuscated code, prompt injection, and other red flags.

## Quick Start

```bash
# Scan a local skill folder
python3 scripts/scan.py /path/to/skill

# Verbose output (show matched lines)
python3 scripts/scan.py /path/to/skill --verbose

# JSON output (for automation)
python3 scripts/scan.py /path/to/skill --json
```

## Workflow: Scan Before Install

1. Download or locate the skill folder
2. Run `python3 scripts/scan.py <skill-path> --verbose`
3. Review findings by severity (CRITICAL/HIGH = do not install)
4. Report results to user with recommendation

## Score Interpretation

| Score | Meaning | Recommendation |
|-------|---------|----------------|
| CLEAN | No issues found | Safe to install |
| INFO | Minor notes only | Safe to install |
| REVIEW | Medium-severity findings | Review manually before installing |
| SUSPICIOUS | High-severity findings | Do NOT install without thorough manual review |
| DANGEROUS | Critical findings detected | Do NOT install — likely malicious |

## Exit Codes

- `0` = CLEAN/INFO
- `1` = REVIEW
- `2` = SUSPICIOUS
- `3` = DANGEROUS

## Rules Reference

See `references/rules.md` for full list of detection rules, severity levels, and whitelisted domains.

## Limitations

- Pattern-based detection — cannot catch all obfuscation techniques
- No runtime analysis — only static scanning
- False positives possible for legitimate tools that access network/files
- Always combine with manual review for HIGH/MEDIUM findings

搜索