中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 25/100
上次扫描：1 天前 重新扫描
25 /100
skill-shield
OpenClaw extension security management system - scans installed extensions for security risks, maintains allowlists/blocklists
Legitimate security scanner for OpenClaw extensions with minor documentation gaps; hook references non-existent script but no confirmed malicious behavior detected.
技能名称skill-shield
分析耗时35.4s
引擎pi
✓
可以安装
Verify the tui-startup.py script exists if using the hook functionality; otherwise safe to use for extension security scanning.

安全发现 2 项

严重性 安全发现 位置
低危
Hook references non-existent script 文档欺骗
The shield-scan.js hook references 'scripts/tui-startup.py' which is not included in the package. While this doesn't cause immediate harm, it suggests incomplete implementation or potential for malicious script injection.
const STARTUP_SCRIPT = path.join(SHIELD_DIR, 'scripts', 'tui-startup.py');
→ Either remove the hook reference to tui-startup.py or include the actual script. If keeping the hook, declare shell execution in SKILL.md.
 hook/shield-scan.js:14
低危
Undeclared shell execution capability 权限提升
The hook module uses Node.js execSync to execute Python scripts, but this shell execution capability is not declared in SKILL.md metadata.
const result = execSync(`python3 "${STARTUP_SCRIPT}"`, {...});
→ Declare shell:WRITE in allowedTools if hook functionality is intended for production.
 hook/shield-scan.js:18
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 shield.py:107 - os.walk traversal of skills directory
命令执行 NONE WRITE ✗ 越权 hook/shield-scan.js:18 - execSync references non-existent script
网络访问 NONE NONE — No network requests found in codebase
数据库 READ READ ✓ 一致 shield.py:55 - reads risk database JSON
环境变量 NONE NONE — No os.environ iteration found
凭证 NONE NONE — No credential access patterns detected

目录结构

6 文件 · 31.0 KB · 1007 行
Python 2f · 511L Markdown 2f · 447L JavaScript 1f · 39L JSON 1f · 10L
├─ ▾ 📁 hook
│ └─ 📜 shield-scan.js JavaScript 39L · 1.1 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 generate_report.py Python 87L · 3.0 KB
│ └─ 🐍 shield.py Python 424L · 15.9 KB
├─ 🔑 config.json ⚠ JSON 10L · 183 B
├─ 📝 README.md Markdown 227L · 5.1 KB
└─ 📝 SKILL.md Markdown 220L · 5.8 KB

依赖分析 1 项

包名版本来源已知漏洞备注
Python standard library only 3.6+ stdlib 否 No pip packages - uses only os, re, json, glob, hashlib, pathlib, datetime, argparse, typing

安全亮点

✓ Uses only Python standard library - no external dependencies to compromise
✓ No credential harvesting or sensitive path access
✓ No network exfiltration or C2 communication
✓ No obfuscation or base64-encoded payloads
✓ Legitimate security scanning tool with proper risk categorization
✓ Open-source readable code with no hidden functionality beyond declared scope