中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：17 小时前 重新扫描
5 /100
ocas-elephas
Elephas: long-term knowledge graph (Chronicle) maintenance skill
Elephas is a legitimate knowledge graph maintenance skill with well-documented behavior. The base64 decoding at line 266 is standard GitHub API usage for self-update, not obfuscation.
技能名称ocas-elephas
分析耗时47.1s
引擎pi
✓
可以安装
This skill is safe to use. No security concerns identified.
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 skill.json declares read access to ~/openclaw/* directories; references show rea…
文件系统 WRITE WRITE ✓ 一致 skill.json declares write access to ~/openclaw/{db,journals,data}/ocas-elephas/;…
网络访问 NONE READ ✓ 一致 elephas.update uses gh api to fetch remote version (SKILL.md:266); not declared …
1 严重 2 项发现
🔒
严重 编码执行 Base64 编码执行（代码混淆）
base64 -d
SKILL.md:266
📧
提示 邮箱 邮箱地址
[email protected]
skill.json:6

目录结构

8 文件 · 44.5 KB · 1217 行
Markdown 7f · 1196L JSON 1f · 21L
├─ ▾ 📁 references
│ ├─ 📝 ingestion_pipeline.md Markdown 179L · 6.1 KB
│ ├─ 📝 init_pattern.md Markdown 41L · 1.3 KB
│ ├─ 📝 journal.md Markdown 190L · 6.3 KB
│ ├─ 📝 ontology.md Markdown 86L · 3.2 KB
│ └─ 📝 schemas.md Markdown 338L · 10.3 KB
├─ 📝 README.md Markdown 68L · 4.3 KB
├─ 📋 skill.json JSON 21L · 1.1 KB
└─ 📝 SKILL.md Markdown 294L · 11.9 KB

安全亮点

✓ Well-documented skill with clear responsibility boundaries
✓ Uses platform-provided library (real_ladybug) rather than arbitrary shell commands
✓ All file operations scoped to designated openclaw directories
✓ Comprehensive journal and audit trail system
✓ Identity merges are reversible with full merge history preserved
✓ No credential access, no sensitive path traversal (no ~/.ssh, ~/.aws, .env access)
✓ Atomic journal writes (write to .tmp, then rename)
✓ Clear escalation rules for candidate promotion with confidence scoring
✓ No base64 obfuscation or hidden functionality - self-update uses standard GitHub API format