扫描报告
5 /100
security-audit
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
This is a legitimate security auditing tool for Clawdbot deployments that performs documented credential scanning, port checks, configuration validation, and file permission audits. All capabilities are declared and the code does not exhibit malicious behavior.
可以安装
This skill is safe to use. Ensure it runs in an isolated environment with appropriate permissions when scanning for credentials, as expected for security audit tools.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 文件系统 | READ | READ | ✓ 一致 | SKILL.md declares file scanning; code uses fs.readFileSync to read config files |
| 文件系统 | WRITE | WRITE | ✓ 一致 | SKILL.md declares --fix mode; code uses fs.chmodSync and fs.writeFileSync for .g… |
| 命令执行 | READ | READ | ✓ 一致 | SKILL.md declares 'native system tools'; code uses execSync for ss/netstat/git l… |
| 环境变量 | READ | READ | ✓ 一致 | SKILL.md declares credential scanning; code scans for API keys/tokens in environ… |
目录结构
3 文件 · 17.8 KB · 608 行 JavaScript 1f · 505L
Markdown 1f · 102L
JSON 1f · 1L
├─
▾
scripts
│ └─
audit.cjs
JavaScript
├─
_meta.json
JSON
└─
SKILL.md
Markdown
安全亮点
✓ All capabilities declared in SKILL.md - credential scanning, port checks, config validation, permission audits, auto-fix
✓ No exfiltration of credentials - the skill only DETECTS credentials, does not transmit them
✓ Auto-fix only modifies file permissions (chmod 600) and creates .gitignore - legitimate security hardening
✓ No hardcoded external IPs or suspicious network connections
✓ No obfuscation techniques (base64, eval, atob) detected
✓ No credential harvesting for malicious purposes - this is a security scanning tool
✓ Regex patterns match common security scanning practices for API keys, tokens, passwords
✓ Uses standard Unix tools (ss, netstat, git) as documented