skill-index 安全扫描报告 — 可信 | ClawSafe

5 /100

skill-index

Auto-scan all installed skills, generate a categorized INDEX.md, and keep it in sync via git hooks.

Legitimate skill indexer that scans SKILL.md files and generates an INDEX.md catalog with git hook auto-update functionality. No malicious behavior detected.

技能名称skill-index

分析耗时22.6s

引擎pi

✓

可以安装

Skill is safe to use. Consider adding explicit allowed-tools declaration in SKILL.md for completeness.

安全发现 1 项

严重性	安全发现	位置
低危	Missing allowed-tools declaration SKILL.md does not declare the shell:WRITE capability needed for bash script execution, though this is standard for CLI-based skills. `No allowed-tools section in YAML frontmatter` → Add allowed-tools declaration: shell:WRITE for Bash tool usage	`SKILL.md:1`

资源类型	声明权限	推断权限	状态	证据
命令执行	`NONE`	`WRITE`	✓ 一致	install-hooks.sh:1, register.sh:1 - both start with #!/bin/bash
文件系统	`NONE`	`WRITE`	✓ 一致	register.sh writes to skills/INDEX.md; install-hooks.sh writes to .git/hooks/

目录结构

3 文件 · 8.6 KB · 251 行

Shell 2f · 172L Markdown 1f · 79L

├─ 🔧 install-hooks.sh Shell 55L · 1.6 KB

├─ 🔧 register.sh Shell 117L · 4.9 KB

└─ 📝 SKILL.md Markdown 79L · 2.1 KB

安全亮点

✓ No network requests or external data transmission

✓ No credential access (no ~/.ssh, ~/.aws, .env access)

✓ No base64 encoding/decoding or eval statements

✓ No remote script execution (curl|bash, wget|sh)

✓ No hidden functionality - code is straightforward and matches documentation

✓ Git hooks are clearly scoped to skill index updates only

✓ No data exfiltration or suspicious outbound connections

✓ Uses mktemp with trap for safe temporary file handling

✓ Uses sort -z for null-delimited processing (safe with filenames)