메뉴
Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
🧠 ontology-clawra v5.1 - Local Ontology Reasoning & Learning Engine **USE THIS SKILL WHENEVER** you need structured reasoning, knowledge graph management, logical inference, or learning from interactions. This is your go-to tool for: - Building and querying ontology knowledge graphs (concepts, entities, relationships) - Performing confidence-based reasoning with evidence tracking - Recording insights and patterns from completed tasks - Local memory search and knowledge retrieval **Key Use Cases:** - Before making complex decisions: "Let me use ontology-clawra to reason about this" - After completing tasks: "Record this learning to ontology-clawra" - Building domain expertise: "Create concepts for [domain] in ontology-clawra" - Analyzing patterns: "Query ontology-clawra for similar past cases" **Core Capabilities:** ✅ Local ontology storage in `~/.openclaw/skills/ontology-clawra/memory/` ✅ Confidence calculation (CONFIRMED/ASSUMED/SPECULATIVE) ✅ Learning from user confirmations ✅ Local memory search (no ne
Complete guide to using and extending Hermes Agent — CLI usage, setup, configuration, spawning additional agents, gateway platforms, skills, voice, tools, profiles, and a concise contributor reference. Load this skill when helping users configure Hermes, troubleshoot issues, spawn agent instances, or make code contributions.
Git push to HTTPS remote using token authentication — avoids SSH setup, works in CI/automated environments.
从 GitHub 历史中彻底清除敏感文件的完整流程 — 使用 git filter-repo + force push，适用于清理意外提交的个人文件、工作文件等
清理 GitHub 历史和 ClawHub 中意外泄露的个人/工作文件
Configure WhatsApp and Telegram messaging platforms on Hermes Agent
| name | skill-vetter |
| version | 1.0.0 |
| user-invocable | true |
| description | Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns. |
Security gate that runs multiple scanners against a skill before installation.
Use before installing ANY skill to Claude Code, OpenClaw, or your other favorite AI agent — whether from ClawHub, GitHub, or any external source.
Ask the user: "Should I run skill-vetter on this before installing?" whenever they mention installing a new skill.
bash {baseDir}/scripts/check-deps.sh
Fix any missing dependencies before proceeding.
bash {baseDir}/scripts/vett.sh "<skill-name-or-path>"
The argument can be:
youtube-summarizehttps://github.com/user/repo/tmp/my-skill/| Verdict | Meaning | Action |
|---|---|---|
| BLOCKED | CRITICAL or HIGH findings | Do NOT install. Show findings. |
| REVIEW | Medium severity findings | Show findings, ask user to decide. |
| SAFE | All scanners passed | Proceed with installation. |
Always show the user:
Never install the skill automatically. Always confirm with the user after showing results.
| Scanner | What It Checks |
|---|---|
| aguara | Prompt injection, obfuscation, suspicious LLM calls |
| skill-analyzer | Known malicious patterns, CVE database |
| secrets-scan | Hardcoded API keys, tokens, credentials |
| structure-check | Missing SKILL.md, malformed YAML, dangerous files |
════════════════════════════════════════════════════════════
SKILL VETTER — Security Scan: malicious-skill
Path: /tmp/skill-vetter-abc123/malicious-skill
════════════════════════════════════════════════════════════
[1/4] aguara............. ✅ PASS
[2/4] skill-analyzer..... ❌ FAIL (HIGH: prompt injection pattern)
[3/4] secrets-scan....... ⚠️ WARN (Medium: base64 encoded string)
[4/4] structure-check.... ✅ PASS
════════════════════════════════════════════════════════════
VERDICT: BLOCKED
Reasons: 1 HIGH, 1 MEDIUM
════════════════════════════════════════════════════════════
Do NOT install this skill. It contains:
- HIGH: Prompt injection in SKILL.md (line 47)
- MEDIUM: Base64 encoded string in scripts/run.sh (line 12)
aguara — Go-based prompt scannerskill-analyzer — Cisco AI skill scanner (Python)python3 — For additional checkscurl, jq — For API calls and JSON parsingRun check-deps.sh to verify all tools are installed.