Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent security-scanner skill, but it needs review because its install guard handles untrusted archives unsafely and its scan results can overstate how complete the review was.
Review before installing. Run it only on skill copies in a disposable directory, avoid elevated privileges, do not treat a PASS result as proof a skill is safe, manually inspect unsupported files, and be careful scanning .skill archives until archive limits and temporary-directory cleanup are added.
scripts/security_scanner.py:190Security scanner omits instruction-bearing and unsupported file types from dangerous-pattern analysis
scripts/install_guard.py:55Unbounded extraction of untrusted Skill archives permits resource exhaustion
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- **Zero-day vulnerabilities**: Unknown attack patterns
- **Logic bombs**: Time/delayed triggers
- **Polymorphic code**: Self-modifying malware
- **External payloads**: Code downloaded at runtime
- **Social engineering**: Tricking users into actions
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
u[0-9a-fA-F]{4}){10,}|base64\.(b64decode|decodestring)',
"description": "检测到可能的代码混淆，隐藏真实意图",
"risk": RiskLevel.HIGH,
"recommendation": "避免使用混淆代码，保持代码可读性和可审计性"
},
"SUSPICIOUS001": {
"name": "键盘记录特征",
"pattern": r'\b(keyboard|pynput|hook|GetAsyncKeyState|keylogger)',
"description": "可能包含键盘记录功能",
"risk": RiskLevel.CRITICAL,
"recommendation": "OpenClaw技能不应包含键盘记录功能，这是明确禁止的行为"
},
"SUSPICIOUS002": {
"name": "屏幕捕获特征",
"pattern": r'\b(pyautogui\.screenshot|PIL\.ImageGrab|mss|screenshot|grab\s*\()',
"description": "可能包含屏幕截图/录制功能",
"risk": RiskLevel.HIGH,
"recommendation": "屏幕捕获涉及隐私，必须在SKILL.md中明确�
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
u[0-9a-fA-F]{4}){10,}|base64\.(b64decode|decodestring)',
"description": "检测到可能的代码混淆，隐藏真实意图",
"risk": RiskLevel.HIGH,
"recommendation": "避免使用混淆代码，保持代码可读性和可审计性"
},
"SUSPICIOUS001": {
"name": "键盘记录特征",
"pattern": r'\b(keyboard|pynput|hook|GetAsyncKeyState|keylogger)',
"description": "可能包含键盘记录功能",
"risk": RiskLevel.CRITICAL,
"recommendation": "OpenClaw技能不应包含键盘记录功能，这是明确禁止的行为"
},
"SUSPICIOUS002": {
"name": "屏幕捕获特征",
"pattern": r'\b(pyautogui\.screenshot|PIL\.ImageGrab|mss|screenshot|grab\s*\()',
"description": "可能包含屏幕截图/录制功能",
"risk": RiskLevel.HIGH,
"recommendation": "屏幕捕获涉及隐私，必须在SKILL.md中明确�
The skill documentation demonstrates and encourages capabilities that invoke shell execution, read/write files, and process JSON output from a subprocess, but the manifest declares no explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: consumers may install or run the skill without clear authorization boundaries, increasing the chance that powerful operations are available implicitly or reviewed inadequately.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
| EXEC001 | Code Execution Functions | `\b(eval\|exec\|compile\|__import__\|execfile)\s*\(` | Critical |
| EXEC002 | System Command Execution | `\b(os\.system\|subprocess\.(call\|run\|Popen\|check_output)\|popen\|spawn\|shell=True)\s*\(` | High |
**Why it matters**: These functions can execute arbitrary code, bypassing normal security controls.
**Common legitimate uses**:
- Running external tools (ffmpeg, git, etc.)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| FILE001 | File Deletion | `\b(os\.remove\|os\.rmdir\|shutil\.rmtree\|os\.unlink)` | Medium |
| FILE002 | File Writing | `\b(open\s*\(\s*[^,\)]*,\s*['"]w\|fs\.writeFile)` | Low |
**Why it matters**: File operations can destroy data, plant malware, or modify system files.
**Common legitimate uses**:
- Creating output files
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if strict:
cmd.append("--strict")
result = subprocess.run(cmd, capture_output=True, text=True)
try:
return json.loads(result.stdout)
This code embeds user-facing and maintenance-relevant comments in Chinese (for example the RiskLevel descriptions) within an otherwise English-language file. That imposes a locale choice on readers and maintainers without offering an alternative or documenting that the tool is intended for a Chinese-only audience.
No suspicious patterns detected.