中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
skill-downloader
Discover, compare, review, install, or update OpenClaw skills from trusted sources with a review-first workflow
This is a policy-focused documentation skill for discovering and managing OpenClaw skills; no executable code or malicious behavior found, though capability declarations are incomplete.
技能名称skill-downloader
分析耗时25.1s
引擎pi
✓
可以安装
Consider adding explicit capability declarations for filesystem:WRITE and network:READ to align documentation with the implied installation and discovery workflows.

安全发现 2 项

严重性 安全发现 位置
低危
Incomplete capability declarations
The SKILL.md describes installation workflows (which require filesystem writes) and searching trusted sources (which requires network access), but does not explicitly declare these capabilities in the frontmatter.
name: skill-downloader
→ Add capability declarations: filesystem: WRITE, network: READ to frontmatter for transparency
 SKILL.md:1
提示
Documentation-only skill
This skill contains only markdown documentation files with no executable code, scripts, or dependencies.
---
→ No action needed - pure policy documentation
 SKILL.md:1
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 SKILL.md: 'installing or updating a skill' implies filesystem writes
网络访问 NONE READ ✓ 一致 SKILL.md: 'search trusted sources' implies network access
命令执行 NONE NONE — No shell execution found
环境变量 NONE NONE — No environment access found
技能调用 NONE NONE — Skill invokes other skills via documentation only
剪贴板 NONE NONE — No clipboard access found
浏览器 NONE NONE — No browser access found
数据库 NONE NONE — No database access found

目录结构

3 文件 · 6.7 KB · 189 行
Markdown 3f · 189L
├─ ▾ 📁 references
│ └─ 📝 advanced-workflows.md Markdown 39L · 1.2 KB
├─ 📝 README.md Markdown 48L · 1.5 KB
└─ 📝 SKILL.md Markdown 102L · 4.0 KB

安全亮点

✓ Clear review-first workflow prevents automatic execution
✓ Explicit approval requirement before installation
✓ Trusted sources policy limits exposure to malicious packages
✓ Safety policy emphasizes inspection before writing files
✓ No executable code or dependencies found
✓ No credential access or exfiltration patterns
✓ No base64, eval, or shell injection vectors