中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：18 小时前 重新扫描
5 /100
credential-vault
Encrypted credential storage for OpenClaw agents
Legitimate encrypted credential storage tool with solid AES-256-GCM cryptography, clear documentation, no network exfiltration, and no malicious behavior detected.
技能名称credential-vault
分析耗时35.1s
引擎pi
✓
可以安装
This skill is safe to use. The flagged IOCs are test credentials in test files (expected) and a documentation URL - neither represents a security risk in production.
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 scripts/vault.py:1 - Creates ~/.openclaw/vault/vault.enc.json
环境变量 READ NONE ✓ 一致 SKILL.md mentions VAULT_MASTER_PASSWORD but code doesn't access os.environ
命令执行 NONE NONE — No subprocess or shell execution found
网络访问 NONE NONE — SKILL.md explicitly states 'Local only — No network sync (by design)'
2 高危 3 项发现
🔑
高危 API 密钥 疑似硬编码凭证
password = "test-password-12345"
tests/test_roundtrip.py:23
🔑
高危 API 密钥 疑似硬编码凭证
password = "correct-password"
tests/test_roundtrip.py:78
🔗
中危 外部 URL 外部 URL
https://openclaw.com
README.md:353

目录结构

13 文件 · 52.9 KB · 2028 行
Markdown 3f · 1003L Python 9f · 1002L TOML 1f · 23L
├─ ▾ 📁 lib
│ ├─ 🐍 __init__.py Python 1L · 75 B
│ ├─ 🐍 audit.py Python 59L · 1.8 KB
│ ├─ 🐍 crypto.py Python 106L · 2.9 KB
│ ├─ 🐍 expiry.py Python 76L · 2.0 KB
│ └─ 🐍 store.py Python 267L · 8.3 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 __init__.py Python 1L · 40 B
│ └─ 🐍 vault.py Python 329L · 10.0 KB
├─ ▾ 📁 tests
│ ├─ 🐍 __init__.py Python 1L · 34 B
│ └─ 🐍 test_roundtrip.py Python 162L · 5.0 KB
├─ 📝 EXAMPLE.md Markdown 440L · 9.0 KB
├─ 📄 pyproject.toml TOML 23L · 432 B
├─ 📝 README.md Markdown 354L · 8.0 KB
└─ 📝 SKILL.md Markdown 209L · 5.4 KB

依赖分析 2 项

包名版本来源已知漏洞备注
cryptography >=43.0.0 pip 否 Uses minimum version constraint; recommend pinning to specific version
pytest >=8.0.0 pip (dev) 否 Dev-only dependency

安全亮点

✓ Solid AES-256-GCM encryption with PBKDF2 (600,000 iterations) per OWASP recommendations
✓ Clear documentation with threat model explaining what is and isn't protected
✓ No network requests or data exfiltration
✓ Audit logging that explicitly excludes credential values
✓ Uses reputable cryptography library (pyca/cryptography)
✓ Secure file permissions (0600) set on vault file
✓ No credential harvesting from environment or sensitive paths
✓ No obfuscation or base64-encoded payloads
✓ Session key automatically cleared on lock command
✓ All functionality declared in SKILL.md