shoofly-plugin-scan
Scans an OpenClaw plugin directory for security issues before installation.
Usage
CODEBLOCK0
Checks
- 1. Credential patterns — API keys (sk-, ghp, AKIA*), private keys
- Obfuscated code — long hex/base64 strings, eval(), Function() constructor
- Unusual network calls — URLs not in the trusted allowlist
- Sensitive path access — ~/.ssh, ~/.aws, ~/.gnupg, /etc/passwd, credentials
- Exec patterns — childprocess.exec with variable args, shell: true
Exit codes
| Code | Meaning |
|---|
| 0 | Clean — no findings |
| 1 |
Findings — review before installing |
| 2 | Scan error |
Allowlisted hosts
github.com, npmjs.com, openclaw.ai, clawhub.com, shoofly.dev
shoofly-plugin-scan
在安装之前扫描OpenClaw插件目录的安全问题。
使用方法
bash
shoofly-plugin-scan <插件路径>
检查项
- 1. 凭证模式 — API密钥(sk-、ghp、AKIA*)、私钥
- 混淆代码 — 长十六进制/base64字符串、eval()、Function()构造函数
- 异常网络调用 — 不在受信任白名单中的URL
- 敏感路径访问 — ~/.ssh、~/.aws、~/.gnupg、/etc/passwd、凭据
- 执行模式 — 带变量参数的childprocess.exec、shell: true
退出代码
发现问题 — 安装前请审查 |
| 2 | 扫描错误 |
白名单主机
github.com、npmjs.com、openclaw.ai、clawhub.com、shoofly.dev