扫描您 OpenClaw 工作区中每个已安装的技能，检测危险代码模式。生成每个技能的 SAFE / WARN / DANGEROUS 评级，并提供确凿证据和移除指令。
为什么存在此技能： 约 20% 的 ClawHub 技能已被标记为包含恶意模式，包括凭证收集、shell 注入和 C2 回调。此技能在使用 OpenClaw 自己的内置扫描器（而非第三方）造成损害之前揭示这些问题。
隐私保证： 完全在您的机器上运行。零网络调用。零数据泄露。您可以阅读此技能的每一行——它是一个单独的 SKILL.md 文件。
工作原理
此技能使用 openclaw security audit --deep --json，该命令已经扫描所有已安装技能的危险模式。然后解析、格式化并解释每个技能的发现。没有新的扫描代码。没有依赖。只有 OpenClaw 自己值得信赖的扫描器，输出更清晰。
工作流程
1. 运行扫描器
openclaw security audit --deep --json
捕获完整的 JSON 输出。
2. 提取技能发现
从 JSON 中找到所有 id 以 skills. 开头的条目——这些是特定于技能的发现。需要查找的关键发现 ID：
| 发现 ID | 含义 |
|---|
skills.code_safety | 在技能代码中检测到危险模式 |
skills.untrusted_exec | 技能执行 shell 命令 |
skills.env_harvesting | 技能读取环境变量并发起网络调用 |
skills.network_exfil | 技能向外部主机发送数据 |
skills.permission_escalation | 技能请求提升权限 |
3. 为每个技能评级
为每个已安装的技能分配评级：
| 评级 | 标准 |
|---|
| ✅ SAFE | 未发现危险模式 |
| ⚠️ WARN | Shell 执行或环境访问（非组合）—— 审查源代码 |
| 🔴 DANGEROUS | 环境收集 + 网络发送组合，或已知恶意签名 |
4. 格式化报告
技能安全扫描 — YYYY-MM-DD HH:MM
扫描：X 个技能
安全：X 警告：X 危险：X
──────────────────────────────────────🔴 DANGEROUS — [技能名称]
路径：~/.openclaw/workspace/skills/[技能名称]
问题：[env-harvesting] 读取 API 密钥并发送到外部主机
证据：[文件名]:[行号] — [代码片段]
操作：clawhub uninstall [技能名称]
rm -rf ~/.openclaw/workspace/skills/[技能名称]
⚠️ WARN — [技能名称]
路径：~/.openclaw/workspace/skills/[技能名称]
问题：[dangerous-exec] 通过 child_process 执行 shell 命令
证据：[文件名]:[行号]
操作：使用前审查源代码。如不需要请移除：clawhub uninstall [技能名称]
✅ SAFE — [技能名称]（无发现）
──────────────────────────────────────
建议
[如有任何 DANGEROUS 技能]：立即移除—— 视为已入侵。
[如有任何 WARN 技能]：下次使用前审查上述路径的源代码。
[如全部 SAFE]：您的技能集是干净的。新安装后重新扫描。
5. 可选：自动移除危险技能
如果用户确认，执行 DANGEROUS 评级技能的移除：
# 对于每个名为 [技能名称] 的 DANGEROUS 技能：
clawhub uninstall [技能名称] 2>/dev/null
rm -rf ~/.openclaw/workspace/skills/[技能名称]
始终显示命令并在移除任何内容之前请求确认。
6. 重新扫描以确认
移除任何内容后：
openclaw security audit --deep
确认 skills.code_safety 发现已消失。
调度
要每次安装新技能后自动扫描，或按每日计划扫描：
openclaw cron add --name "skill-safety-scanner:daily" --cron "0 3 *" \
--prompt "Run the skill-safety-scanner skill and report findings to memory."
此技能不做什么
- 不向外部服务器发送任何数据
- 不经明确确认修改任何文件
- 不连接互联网
- 不访问凭证或 API 密钥
- 不安装任何东西
- 单个 SKILL.md 文件—— 在上面检查完整源代码
注意事项
- 每次安装新的 ClawHub 技能后运行此扫描
- WARN 评级并不总是恶意的—— 许多合法技能使用 shell 执行（例如运行 git 或 npm 的工具）。审查源代码并做出您自己的判断。
- DANGEROUS = 同一文件中的环境收集 + 网络发送。这种组合在被动技能中没有合法用例。
- 如果 OpenClaw 更新其扫描器签名，重新运行此技能以捕获新检测到的模式。
Scans every installed skill in your OpenClaw workspace for dangerous code patterns.
Produces a per-skill SAFE / WARN / DANGEROUS rating with exact evidence and removal commands.
Why this exists: ~20% of ClawHub skills have been flagged for malicious patterns including
credential harvesting, shell injection, and C2 callbacks. This skill surfaces those issues
before they can cause damage — using OpenClaw's own built-in scanner, not a third party.
Privacy guarantee: Runs entirely on your machine. Zero network calls. Zero data exfiltration.
You can read every line of this skill — it is a single SKILL.md file.
How it works
This skill uses openclaw security audit --deep --json which already scans all installed skills
for dangerous patterns. It then parses, formats, and explains the findings per-skill.
No new scanning code. No dependencies. Just OpenClaw's own trusted scanner with better output.
Workflow
1. Run the scanner
openclaw security audit --deep --json
Capture the full JSON output.
2. Extract skill findings
From the JSON, find all entries where id starts with skills. — these are skill-specific findings.
Key finding IDs to look for:
| Finding ID | Meaning |
|---|
skills.code_safety | Dangerous patterns detected in skill code |
skills.untrusted_exec | Skill executes shell commands |
skills.env_harvesting | Skill reads env vars AND makes network calls |
skills.network_exfil | Skill sends data to external hosts |
skills.permission_escalation | Skill requests elevated permissions |
3. Rate each skill
For each installed skill, assign a rating:
| Rating | Criteria |
|---|
| ✅ SAFE | No dangerous patterns found |
| ⚠️ WARN | Shell exec OR env access (not combined) — review source |
| 🔴 DANGEROUS | Env harvesting + network send combined, or known malicious signature |
4. Format the report
SKILL SAFETY SCAN — YYYY-MM-DD HH:MM
Scanned: X skills Safe: X Warn: X Dangerous: X──────────────────────────────────────
🔴 DANGEROUS — [skill-name]
Path: ~/.openclaw/workspace/skills/[skill-name]
Issue: [env-harvesting] Reads API keys and sends to external host
Evidence: [filename]:[line] — [code snippet]
Action: clawhub uninstall [skill-name]
rm -rf ~/.openclaw/workspace/skills/[skill-name]
⚠️ WARN — [skill-name]
Path: ~/.openclaw/workspace/skills/[skill-name]
Issue: [dangerous-exec] Executes shell commands via child_process
Evidence: [filename]:[line]
Action: Review source before use. Remove if not needed:
clawhub uninstall [skill-name]
✅ SAFE — [skill-name] (no findings)
──────────────────────────────────────
RECOMMENDATION
[If any DANGEROUS skills]: Remove immediately — treat as compromised.
[If any WARN skills]: Review source at the path above before next use.
[If all SAFE]: Your skill set is clean. Re-scan after any new install.
5. Optional: Auto-remove dangerous skills
If the user confirms, execute removal for DANGEROUS-rated skills:
# For each DANGEROUS skill named [skill-name]:
clawhub uninstall [skill-name] 2>/dev/null
rm -rf ~/.openclaw/workspace/skills/[skill-name]
Always show the command and ask for confirmation before removing anything.
6. Re-scan to confirm
After any removals:
openclaw security audit --deep
Confirm the skills.code_safety finding is gone.
Scheduling
To scan automatically after every new skill install, or on a daily schedule:
openclaw cron add --name "skill-safety-scanner:daily" --cron "0 3 *" \
--prompt "Run the skill-safety-scanner skill and report findings to memory."
What this skill does NOT do
- Does not send any data to external servers
- Does not modify any files without explicit confirmation
- Does not connect to the internet
- Does not access credentials or API keys
- Does not install anything
- Single SKILL.md file — inspect the full source above
Notes
- Run this scan after every new ClawHub skill install
- WARN ratings are not always malicious — many legitimate skills use shell exec (e.g., tools that run git or npm). Review the source and make your own judgment.
- DANGEROUS = env harvesting + network send in the same file. This combination has no legitimate use case in a passive skill.
- If OpenClaw updates its scanner signatures, re-run this skill to catch newly detected patterns.
by