中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：21 小时前 重新扫描
5 /100
lua-scripter (declared in SKILL.md) / self-improving-agent (in _meta.json)
Lua development assistant with self-improvement hooks for learning capture
Legitimate Lua development assistant skill with self-improvement hooks. All scripts are readable, no malicious patterns detected, no network/credential access.
技能名称lua-scripter (declared in SKILL.md) / self-improving-agent (in _meta.json)
分析耗时33.8s
引擎pi
✓
可以安装
This skill is safe to use. The minor documentation mismatch (SKILL.md name vs _meta.json name) is non-security-relevant.
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 extract-skill.sh creates ./skills/<name>/SKILL.md with path validation
命令执行 NONE READ ✓ 一致 Scripts use CLAUDE_TOOL_OUTPUT env var for error detection
环境变量 READ READ ✓ 一致 error-detector.sh reads CLAUDE_TOOL_OUTPUT (documented hook behavior)
网络访问 NONE NONE — No network calls in any script

目录结构

16 文件 · 36.8 KB · 1616 行
Markdown 10f · 1197L Shell 3f · 296L TypeScript 1f · 62L JavaScript 1f · 56L JSON 1f · 5L
├─ ▾ 📁 .learnings
│ ├─ 📝 ERRORS.md Markdown 5L · 75 B
│ ├─ 📝 FEATURE_REQUESTS.md Markdown 5L · 84 B
│ └─ 📝 LEARNINGS.md Markdown 5L · 99 B
├─ ▾ 📁 assets
│ ├─ 📝 LEARNINGS.md Markdown 45L · 1.1 KB
│ └─ 📝 SKILL-TEMPLATE.md Markdown 177L · 3.3 KB
├─ ▾ 📁 hooks
│ └─ ▾ 📁 openclaw
│ ├─ 📜 handler.js JavaScript 56L · 1.6 KB
│ ├─ 📜 handler.ts TypeScript 62L · 1.8 KB
│ └─ 📝 HOOK.md Markdown 23L · 589 B
├─ ▾ 📁 references
│ ├─ 📝 examples.md Markdown 374L · 8.1 KB
│ ├─ 📝 hooks-setup.md Markdown 223L · 4.8 KB
│ └─ 📝 openclaw-integration.md Markdown 248L · 5.5 KB
├─ ▾ 📁 scripts
│ ├─ 🔧 activator.sh Shell 20L · 680 B
│ ├─ 🔧 error-detector.sh Shell 55L · 1.3 KB
│ └─ 🔧 extract-skill.sh Shell 221L · 5.2 KB
├─ 📋 _meta.json JSON 5L · 139 B
└─ 📝 SKILL.md Markdown 92L · 2.5 KB

安全亮点

✓ No network calls or data exfiltration detected
✓ No credential harvesting or sensitive path access
✓ No base64 encoding or obfuscation
✓ Path validation in extract-skill.sh prevents directory traversal
✓ Shell scripts are simple and readable with clear purpose
✓ No remote script execution (curl|bash, wget|sh)
✓ No supply chain risks - no external dependencies