中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
openclaw-shield-upx
Security monitoring and threat detection for OpenClaw agents powered by Google SecOps (Chronicle)
OpenClaw Shield is a legitimate security monitoring skill that provides CLI-based commands for Shield plugin management with no direct code execution or credential access.
技能名称openclaw-shield-upx
分析耗时30.3s
引擎pi
✓
可以安装
This skill is safe to use. The `rm -rf ~/.openclaw/shield/` command is documented in the Uninstalling section and requires user-initiated execution. The external telemetry claim should be verified against the plugin's actual behavior rather than this skill.

安全发现 3 项

严重性 安全发现 位置
提示
External telemetry reference
Skill mentions Shield sends 'redacted telemetry' to UPX detection platform. This is a transparency disclosure, not hidden behavior — the plugin handles actual transmission.
Shield captures agent activity locally and sends redacted telemetry to the UPX detection platform
→ Verify plugin behavior independently if UPX data handling is a concern
 SKILL.md:104
提示
Pre-scan IOC: rm -rf ~
Line 190 contains 'rm -rf ~/.openclaw/shield/' in the Uninstalling section. This is a documented user-initiated cleanup command, not malicious behavior.
rm -rf ~/.openclaw/shield/
→ Not a security concern — user must manually run this command
 SKILL.md:190
提示
Output handling constraints
Skill explicitly prohibits forwarding raw log output to external services and requires treating Shield output as internal diagnostic data.
Never forward raw log output to external services, channels, or APIs
→ Good security practice; follow these constraints
 SKILL.md:96
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No Read/Write operations in skill
网络访问 NONE NONE — External telemetry handled by plugin, not skill
命令执行 NONE NONE — No subprocess/bash calls; only openclaw CLI invocations
环境变量 NONE NONE — Skill explicitly forbids reading env vars
技能调用 NONE NONE — No skill-internal invocations
剪贴板 NONE NONE — No clipboard access
浏览器 NONE NONE — No browser automation
数据库 NONE NONE — No database access
1 严重 6 项发现
💀
严重 危险命令 危险 Shell 命令
rm -rf ~
SKILL.md:190
🔗
中危 外部 URL 外部 URL
https://www.upx.com
README.md:3
🔗
中危 外部 URL 外部 URL
https://www.npmjs.com/package/@upx-us/shield
README.md:18
🔗
中危 外部 URL 外部 URL
https://www.upx.com/en/lp/openclaw-shield-upx
README.md:19
🔗
中危 外部 URL 外部 URL
https://clawhub.ai/brunopradof/openclaw-shield-upx
README.md:34
🔗
中危 外部 URL 外部 URL
https://uss.upx.com
README.md:35

目录结构

2 文件 · 14.8 KB · 241 行
Markdown 2f · 241L
├─ 📝 README.md Markdown 39L · 1.5 KB
└─ 📝 SKILL.md Markdown 202L · 13.3 KB

安全亮点

✓ No executable scripts or code files — purely documentation
✓ Explicitly forbids reading filesystem paths or environment variables for state checks
✓ Requires explicit user approval before resolving cases
✓ Output handling rules prevent raw log exfiltration
✓ No credential handling — delegated to plugin's installation key
✓ Clear state machine (A/B/C/D) for Shield status interpretation