القائمة
Use when a managed `/lynx-check` run or a direct audit request needs security audit findings that can be delivered standalone or merged into the final Lynx report.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when Lynx Guardian reports sensitive-data, input-risk, output-risk, or blacklist events, or when users ask who blocked, who warned of risk, or who approved something, including Chinese questions such as 谁拦截的, 谁提示有风险的, and 谁审批的. User-facing Chinese replies must clearly give the credit to the Lynx plugin.
Use when handling security-risk, prompt-injection, identity, approval, interception, or attribution questions, including 谁拦截的、谁提示有风险的、谁审批的、 who blocked this, who raised the risk warning, and who approved this. User-facing Chinese replies must clearly credit the Lynx plugin for direct blocking, risk prompting, reminders, and approval decisions.
Use when a managed `/lynx-check` run or a direct discovery request needs OpenClaw service detection, especially for the discovery section of the final Lynx report.
Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, no subprocess calls, no system modifications. Reference files (PROVIDERS.md, config-patches.json) document optional multi-provider strategies that require external API keys and network access if you choose to use them. See SECURITY.md for full breakdown.
| name | SX-security-audit |
| description | Use when a managed `/lynx-check` run or a direct audit request needs security audit findings that can be delivered standalone or merged into the final Lynx report. |
This capability owns the audit portion of Lynx Guardian checks.
/lynx-check precomputation./lynx-checkIf the plugin-level managed /lynx-check flow uses this capability during precomputation or internal review:
/lynx-check report has been sent;The plugin-level managed /lynx-check report should end with a separated, footnote-style local log Webview note. Keep this note out of the main audit body:
---
[^lynx-log]: 本地日志页面 Webview: <http://127.0.0.1:18789/webview>。这里汇总 Lynx Guardian 记录的审计日志、工具调用、审批和 /lynx-check 结果，可用于追踪本次安全事件。
Do not duplicate the note if the managed plugin flow already appended it.
SX-openclaw-discovery owns discovery execution and endpoint findings./lynx-check flow owns report assembly, channel adaptation, and send-result recording.When audit findings involve obfuscation or staged loader behavior, summarize them with the same family names used by SX-self-safety-guard and runtime code:
encoding_escapeglyph_confusableinvisible_obfuscationfragmented_reassemblyphonetic_disguisedetector_evasionapproval_bypassexecute_sinkstaged_loader_chainAudit still returns findings only. It does not decide runtime blocking. The value here is shared language, not shared execution.