中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：1 天前 重新扫描
5 /100
openclaw-security-hardening
Complete OpenClaw Agent Security Hardening - Protects against data leaks (storage security) and prompt injection (runtime security)
Legitimate OpenClaw security hardening skill with defensive shell commands properly documented in SKILL.md; the pre-scan flagged rm commands are in-code examples of dangerous patterns to avoid, not actual execution payloads.
技能名称openclaw-security-hardening
分析耗时43.5s
引擎pi
✓
可以安装
No action needed. This skill can be used as-is.
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 SKILL.md documents read-only operations: stat, grep -l for file checks
命令执行 WRITE WRITE ✓ 一致 SKILL.md explicitly declares chmod, git commands, security-check.sh as core func…
环境变量 NONE NONE — Skill references .env files but does not iterate os.environ or harvest secrets
网络访问 NONE NONE — No network calls; external URLs in documentation are references only
技能调用 READ READ ✓ 一致 Core purpose: runtime security checks for other skills
剪贴板 NONE NONE — Not accessed
浏览器 NONE NONE — Not accessed
数据库 NONE NONE — Not accessed
2 严重 7 项发现
💀
严重 危险命令 危险 Shell 命令
rm -rf /
SKILL.md:345
💀
严重 危险命令 危险 Shell 命令
rm -rf ~
SKILL.md:360
🔗
中危 外部 URL 外部 URL
https://semver.org/
CHANGELOG.md:103
🔗
中危 外部 URL 外部 URL
https://your-api-endpoint-here
SKILL.md:96
🔗
中危 外部 URL 外部 URL
https://docs.openclaw.ai/security
SKILL.md:650
🔗
中危 外部 URL 外部 URL
https://www.gnupg.org/gph/en/manual.html
SKILL.md:651
🔗
中危 外部 URL 外部 URL
https://clawhub.com
tests/pre-submit-check.sh:112

目录结构

6 文件 · 34.9 KB · 1492 行
Markdown 4f · 1167L Shell 2f · 325L
├─ ▾ 📁 examples
│ └─ 📝 SOUL-config-example.md Markdown 170L · 3.4 KB
├─ ▾ 📁 tests
│ ├─ 🔧 pre-submit-check.sh Shell 121L · 3.0 KB
│ └─ 🔧 security-test.sh Shell 204L · 5.5 KB
├─ 📝 CHANGELOG.md Markdown 146L · 3.9 KB
├─ 📝 README.md Markdown 159L · 3.2 KB
└─ 📝 SKILL.md Markdown 692L · 15.9 KB

安全亮点

✓ Defensive security tool with no offensive capabilities
✓ All shell commands are clearly documented with purpose and context
✓ Content vs Intent detection framework prevents accidental command execution
✓ Crontab entry is optional, user-initiated, and clearly labeled for monitoring only
✓ pre-submit-check.sh actively scans for real API keys before submission
✓ No third-party dependencies; uses only standard Unix tools
✓ No network egress or data exfiltration paths
✓ Sensitive data handling (.env isolation) is a security best practice
✓ skill_invoke is the declared primary resource — consistent with being a meta-security skill