{ "schemaVersion": "1.0", "item": { "slug": "skill-security", "name": "Skill Security Scanner", "source": "tencent", "type": "skill", "category": "安全合规", "sourceUrl": "https://clawhub.ai/suryast/skill-security", "canonicalUrl": "https://clawhub.ai/suryast/skill-security", "targetPlatform": "OpenClaw" }, "install": { "downloadMode": "redirect", "downloadUrl": "/downloads/skill-security", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=skill-security", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "installMethod": "Manual import", "extraction": "Extract archive", "prerequisites": [ "OpenClaw" ], "packageFormat": "ZIP package", "includedAssets": [ "SKILL.md", "allowlist.txt", "audit-all.sh", "audit.sh", "blocklist.txt", "preinstall-check.sh" ], "primaryDoc": "SKILL.md", "quickSetup": [ "Download the package from Yavira.", "Extract the archive and review SKILL.md first.", "Import or place the package into your OpenClaw setup." ], "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run." } ] }, "sourceHealth": { "source": "tencent", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-04-23T16:43:11.935Z", "expiresAt": "2026-04-30T16:43:11.935Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"", "redirectLocation": null, "bodySnippet": null }, "scope": "source", "summary": "Source download looks usable.", "detail": "Yavira can redirect you to the upstream package for this source.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/skill-security" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] }, "downloadPageUrl": "https://openagent3.xyz/downloads/skill-security", "agentPageUrl": "https://openagent3.xyz/skills/skill-security/agent", "manifestUrl": "https://openagent3.xyz/skills/skill-security/agent.json", "briefUrl": "https://openagent3.xyz/skills/skill-security/agent.md" }, "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run." } ] }, "documentation": { "source": "clawhub", "primaryDoc": "SKILL.md", "sections": [ { "title": "Skill Security Scanner", "body": "Security audit tool for OpenClaw skills. Run before installing any new skill." }, { "title": "Quick Audit", "body": "# Audit a skill directory\n~/workspace/skills/skill-security/audit.sh /path/to/skill\n\n# Audit all installed skills\n~/workspace/skills/skill-security/audit-all.sh" }, { "title": "What It Checks", "body": "CheckRisk LevelPatternNetwork Exfiltration🚨 HIGHrequests., urllib, http.client, socket., fetch(, axiosCredential Harvesting🚨 HIGH.ssh/, .aws/, pass , keyring, credential, secret, token file readsCode Injection🚨 CRITICALexec(, eval(, compile(, Function(, __import__Obfuscation⚠️ MEDIUMbase64.decode, atob, encoded payloadsEnv Dumping⚠️ MEDIUMos.environ, process.env, getenv bulk accessSubprocess Abuse⚠️ MEDIUMsubprocess.run, os.system, child_process with credentials" }, { "title": "Severity Levels", "body": "CRITICAL (🚨): Block installation, report to owner\nHIGH (🔴): Requires manual review before use\nMEDIUM (🟡): Note but allow if from trusted source\nLOW (🟢): Informational only" }, { "title": "Safe Skill Checklist", "body": "Before using any skill:\n\n✅ Is it from a trusted source? (official OpenClaw, known publisher)\n✅ Is the code readable (not obfuscated)?\n✅ Does it document why it needs network/credential access?\n✅ Does it scope file access to its own directory?\n✅ Has it been audited by the community?" }, { "title": "Integration with AGENTS.md", "body": "Add this to your workflow:\n\n## Skill Installation Protocol\n\nBefore loading any new skill:\n1. Run `~/workspace/skills/skill-security/audit.sh `\n2. If CRITICAL/HIGH findings → STOP, alert the user\n3. If MEDIUM findings → Review manually, proceed if justified\n4. If CLEAN → Safe to use" }, { "title": "Automatic Protection", "body": "The scanner creates a blocklist at ./blocklist.txt.\nSkills with CRITICAL findings are automatically added." }, { "title": "Manual Override", "body": "If a skill is flagged but you've verified it's safe:\n\necho \"skill-name:verified:YYYY-MM-DD:reason\" >> allowlist.txt" }, { "title": "Premium Skills", "body": "Like this? Check out our premium skills at skillpacks.dev:\n\n🛡️ Security Suite — Full PII scanning, secrets detection, prompt injection defense — $9.90\n🧠 Structured Memory — Three-tier memory replacing flat MEMORY.md — $9.90\n📋 Planning & Execution — Systematic task plans with batch execution — $9.90\n💎 Bundle — all 3 for $24.90" } ], "body": "Skill Security Scanner\n\nSecurity audit tool for OpenClaw skills. Run before installing any new skill.\n\nQuick Audit\n# Audit a skill directory\n~/workspace/skills/skill-security/audit.sh /path/to/skill\n\n# Audit all installed skills\n~/workspace/skills/skill-security/audit-all.sh\n\nWhat It Checks\nCheck\tRisk Level\tPattern\nNetwork Exfiltration\t🚨 HIGH\trequests., urllib, http.client, socket., fetch(, axios\nCredential Harvesting\t🚨 HIGH\t.ssh/, .aws/, pass , keyring, credential, secret, token file reads\nCode Injection\t🚨 CRITICAL\texec(, eval(, compile(, Function(, __import__\nObfuscation\t⚠️ MEDIUM\tbase64.decode, atob, encoded payloads\nEnv Dumping\t⚠️ MEDIUM\tos.environ, process.env, getenv bulk access\nSubprocess Abuse\t⚠️ MEDIUM\tsubprocess.run, os.system, child_process with credentials\nSeverity Levels\nCRITICAL (🚨): Block installation, report to owner\nHIGH (🔴): Requires manual review before use\nMEDIUM (🟡): Note but allow if from trusted source\nLOW (🟢): Informational only\nSafe Skill Checklist\n\nBefore using any skill:\n\n✅ Is it from a trusted source? (official OpenClaw, known publisher)\n✅ Is the code readable (not obfuscated)?\n✅ Does it document why it needs network/credential access?\n✅ Does it scope file access to its own directory?\n✅ Has it been audited by the community?\nIntegration with AGENTS.md\n\nAdd this to your workflow:\n\n## Skill Installation Protocol\n\nBefore loading any new skill:\n1. Run `~/workspace/skills/skill-security/audit.sh `\n2. If CRITICAL/HIGH findings → STOP, alert the user\n3. If MEDIUM findings → Review manually, proceed if justified\n4. If CLEAN → Safe to use\n\nAutomatic Protection\n\nThe scanner creates a blocklist at ./blocklist.txt. Skills with CRITICAL findings are automatically added.\n\nManual Override\n\nIf a skill is flagged but you've verified it's safe:\n\necho \"skill-name:verified:YYYY-MM-DD:reason\" >> allowlist.txt\n\nPremium Skills\n\nLike this? Check out our premium skills at skillpacks.dev:\n\n🛡️ Security Suite — Full PII scanning, secrets detection, prompt injection defense — $9.90\n🧠 Structured Memory — Three-tier memory replacing flat MEMORY.md — $9.90\n📋 Planning & Execution — Systematic task plans with batch execution — $9.90\n💎 Bundle — all 3 for $24.90" }, "trust": { "sourceLabel": "tencent", "provenanceUrl": "https://clawhub.ai/suryast/skill-security", "publisherUrl": "https://clawhub.ai/suryast/skill-security", "owner": "suryast", "version": "1.0.1", "license": null, "verificationStatus": "Indexed source record" }, "links": { "detailUrl": "https://openagent3.xyz/skills/skill-security", "downloadUrl": "https://openagent3.xyz/downloads/skill-security", "agentUrl": "https://openagent3.xyz/skills/skill-security/agent", "manifestUrl": "https://openagent3.xyz/skills/skill-security/agent.json", "briefUrl": "https://openagent3.xyz/skills/skill-security/agent.md" } }