Menu
AI Agent Skills Security Scanner - Scan skills for malicious code, security vulnerabilities and risk patterns with CVSS 3.1 scoring
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing data, (3) Modify existing spreadsheets while preserving formulas, (4) Data analysis and visualization in spreadsheets, or (5) Recalculating formulas
Calendar and scheduling management. Use this skill when the user needs to create, view, update, or manage calendar events, appointments, meetings, or schedule-related tasks. Supports ICS file format, recurring events, and timezone handling.
Code review assistance with linting, style checking, and best practices
| name | skill-security-scanner |
| description | AI Agent Skills Security Scanner - Scan skills for malicious code, security vulnerabilities and risk patterns with CVSS 3.1 scoring |
| metadata | {"version":"1.0.0","author":"Skill Security Scanner Team","license":"MIT","homepage":"https://gitee.com/yzj1/skill-security-scanner","openclaw":{"emoji":"🛡️","os":["windows","darwin","linux"]},"lobehub":{"category":"security","tags":["security","scanner","malware-detection","code-audit"]}} |
AI Agent Skills 安全扫描工具 - 使用 CVSS 3.1 评分系统检测 Skills 中的恶意代码、安全漏洞和风险模式。
| 风险等级 | 检测器数量 | 典型威胁 |
|---|---|---|
| 🔴 CRITICAL | 4 | 硬编码凭证、远程代码执行、命令注入 |
| 🟠 HIGH | 7 | 凭证盗取、持久化驻留、数据外传 |
| 🟡 MEDIUM | 3 | Base64 编码隐藏、异常网络连接 |
| 🟢 LOW | 1 | 隐藏字符注入 |
Scan the skills in directory /path/to/skills for security issues
Scan skills at /path/to/skills and output HTML report
Scan skills at /path/to/skills and output JSON format
Scan with LLM deep analysis enabled
Scan with IOC detection and YARA rules enabled
Scan and only show high severity issues
Scan and filter out low severity findings
| 参数 | 说明 | 示例 |
|---|---|---|
--path | 扫描路径（必需） | --path /path/to/skills |
--format | 输出格式 | --format html |
--severity | 最低风险等级 | --severity high |
--use-llm | 启用 LLM 分析 | --use-llm |
--use-ioc | 启用 IOC 检测 | --use-ioc |
--use-yara | 启用 YARA 规则 | --use-yara |
--output | 输出文件 | -o report.html |
🛡️ Skill Security Scanner Report
==================================================
📁 Skill: example-skill
├── 🔴 CRITICAL [CVSS 9.8]
│ └── SecretsDetector: 硬编码 API 密钥
│ File: src/api.py:15
├── 🟠 HIGH [CVSS 7.5]
│ └── NetworkDetector: 异常网络连接
│ File: src/client.py:42
Summary: 2 risks found
生成专业美观的 HTML 报告，包含风险分布图表、详细漏洞说明和修复建议。
适用于自动化集成和 CI/CD 流程。
维护者：Skill Security Scanner Team
版本：1.0.0