Skill Security Scanner
Protect your OpenClaw installation from malicious skills. This scanner performs static analysis on skill code to detect:
- - Code Execution Threats:
eval, exec, os.system, subprocess calls - Data Exfiltration: Hidden network requests, suspicious URLs, IP connections
- System Compromise: File deletion, permission changes, privilege escalation
- Credential Theft: Environment variable access, secret harvesting
- Cryptojacking: Mining malware, suspicious compute patterns
- Obfuscation: Hidden code, base64 encoding, minification
- Spyware: Keyloggers, screen capture, surveillance features
Quick Start
CODEBLOCK0
Understanding Results
Verdict Levels
| Verdict | Emoji | Meaning | Action |
|---|
| PASS | 🟢 | No critical issues found | Safe to install |
| REVIEW |
🟡 | Some concerns, review recommended | Check findings before installing |
|
WARNING | 🟠 | High-risk patterns detected | Strongly reconsider installation |
|
REJECT | 🔴 | Critical threats identified |
DO NOT INSTALL |
Security Score
- - 90-100: Excellent - minimal risk
- 70-89: Good - minor issues
- 50-69: Fair - requires review
- 0-49: Poor - significant risks
Detection Rules
Critical (🔴)
| Rule | Description | Example |
|---|
| EXEC001 | Code execution functions | INLINECODE4 , exec(), INLINECODE6 |
| SUSPICIOUS001 |
Keylogger functionality |
pynput,
keyboard modules |
| SUSPICIOUS003 | Cryptocurrency mining |
mining,
bitcoin,
stratum+tcp |
High (🟠)
| Rule | Description | Example |
|---|
| EXEC002 | System command execution | INLINECODE12 , INLINECODE13 |
| NET002 |
Raw socket connections |
socket.connect() |
| ENV001 | Sensitive credential access |
os.environ['PASSWORD'] |
| OBF001 | Code obfuscation | Base64, hex-encoded code |
| SUSPICIOUS002 | Screen capture |
pyautogui.screenshot() |
| NET004 | Short URL usage |
bit.ly,
tinyurl links |
Medium (🟡)
| Rule | Description | Example |
|---|
| NET001 | HTTP network requests | INLINECODE19 , INLINECODE20 |
| ENV002 |
Environment enumeration |
os.environ.items() |
| FILE001 | File deletion |
os.remove(),
shutil.rmtree() |
| DATA001 | Unsafe deserialization |
pickle.loads(),
yaml.load() |
| NET003 | Hardcoded IP addresses | Direct IP in URLs |
| OBF002 | Base64 encoded blocks | Large base64 strings |
Low/Info (🔵/⚪)
| Rule | Description |
|---|
| FILE002 | File write operations |
| CRYPTO001 |
Cryptographic operations |
| DOC001 | Insufficient documentation |
| DOC002 | Missing security statements |
Workflow
Before Installing a New Skill
- 1. Download the skill to a temporary directory
- Run the security scanner
- Review the verdict:
- 🟢
PASS: Proceed with installation
- 🟡
REVIEW: Examine findings, verify legitimate use
- 🟠
WARNING: Only install from trusted sources
- 🔴
REJECT: Do not install
- 4. For 🟡/🟠 findings, manually review the flagged code
- Confirm the skill's behavior matches its documentation
Before Updating an Existing Skill
- 1. Run scanner on the new version
- Compare results with previous version's scan
- Check for new critical/high findings
- Review any new network/file operations
Automated Integration
Add to your skill installation workflow:
CODEBLOCK1
Handling False Positives
Some legitimate skills may trigger warnings:
- - Network requests: Skills that fetch data from APIs
- File operations: Skills that modify documents
- Encryption: Skills handling sensitive data
When you trust the source and understand the functionality, you can:
- 1. Review the specific code flagged
- Verify it matches the documented purpose
- Manually approve if confident
Reporting Issues
If you find a skill with confirmed malicious intent:
- 1. Do not install or run it
- Report to the skill repository/hosting platform
- Notify OpenClaw community channels
- Share scan report (without executing the skill)
Best Practices
- 1. Only install skills from trusted sources
- Always scan before installing - even from trusted sources
- Review findings carefully - understand what the skill does
- Keep scanner updated - new detection rules added regularly
- Use strict mode for untrusted sources - catches more suspicious patterns
- Check skill updates - re-scan when updating existing skills
Exit Codes
The scanner returns specific exit codes:
| Code | Meaning |
|---|
| 0 | PASS or REVIEW - installation may proceed |
| 1 |
WARNING - high-risk patterns found |
| 2 | REJECT - critical threats detected |
Use in scripts:
CODEBLOCK2
技能安全扫描器
保护您的OpenClaw安装免受恶意技能侵害。该扫描器对技能代码执行静态分析，检测以下内容：
- - 代码执行威胁：eval、exec、os.system、subprocess调用
- 数据泄露：隐藏的网络请求、可疑URL、IP连接
- 系统入侵：文件删除、权限更改、权限提升
- 凭证窃取：环境变量访问、秘密信息收集
- 加密货币劫持：挖矿恶意软件、可疑计算模式
- 代码混淆：隐藏代码、base64编码、代码压缩
- 间谍软件：键盘记录器、屏幕捕获、监控功能
快速开始
bash
基础扫描
python scripts/security_scanner.py /path/to/skill
严格模式（捕获更多可疑模式）
python scripts/security_scanner.py /path/to/skill --strict
保存JSON报告
python scripts/security_scanner.py /path/to/skill --format json -o report.json
生成Markdown报告
python scripts/security_scanner.py /path/to/skill --format markdown -o report.md
理解结果
判定等级
| 判定 | 表情 | 含义 | 操作 |
|---|
| 通过 | 🟢 | 未发现严重问题 | 可安全安装 |
| 审查 |
🟡 | 存在一些疑虑，建议审查 | 安装前检查发现 |
|
警告 | 🟠 | 检测到高风险模式 | 强烈建议重新考虑安装 |
|
拒绝 | 🔴 | 发现严重威胁 |
请勿安装 |
安全评分
- - 90-100：优秀 - 风险极低
- 70-89：良好 - 存在小问题
- 50-69：一般 - 需要审查
- 0-49：较差 - 存在重大风险
检测规则
严重 (🔴)
| 规则 | 描述 | 示例 |
|---|
| EXEC001 | 代码执行函数 | eval()、exec()、compile() |
| SUSPICIOUS001 |
键盘记录功能 | pynput、keyboard模块 |
| SUSPICIOUS003 | 加密货币挖矿 | mining、bitcoin、stratum+tcp |
高 (🟠)
| 规则 | 描述 | 示例 |
|---|
| EXEC002 | 系统命令执行 | os.system()、subprocess.call() |
| NET002 |
原始套接字连接 | socket.connect() |
| ENV001 | 敏感凭证访问 | os.environ[PASSWORD] |
| OBF001 | 代码混淆 | Base64、十六进制编码代码 |
| SUSPICIOUS002 | 屏幕捕获 | pyautogui.screenshot() |
| NET004 | 短链接使用 | bit.ly、tinyurl链接 |
中 (🟡)
| 规则 | 描述 | 示例 |
|---|
| NET001 | HTTP网络请求 | requests.get()、fetch() |
| ENV002 |
环境枚举 | os.environ.items() |
| FILE001 | 文件删除 | os.remove()、shutil.rmtree() |
| DATA001 | 不安全反序列化 | pickle.loads()、yaml.load() |
| NET003 | 硬编码IP地址 | URL中的直接IP |
| OBF002 | Base64编码块 | 大型base64字符串 |
低/信息 (🔵/⚪)
| 规则 | 描述 |
|---|
| FILE002 | 文件写入操作 |
| CRYPTO001 |
加密操作 |
| DOC001 | 文档不足 |
| DOC002 | 缺少安全声明 |
工作流程
安装新技能前
- 1. 将技能下载到临时目录
- 运行安全扫描器
- 审查判定结果：
- 🟢
通过：继续安装
- 🟡
审查：检查发现，验证合法用途
- 🟠
警告：仅从可信来源安装
- 🔴
拒绝：请勿安装
- 4. 对于🟡/🟠的发现，手动审查标记的代码
- 确认技能行为与其文档一致
更新现有技能前
- 1. 对新版本运行扫描器
- 将结果与先前版本的扫描结果进行比较
- 检查是否有新的严重/高风险发现
- 审查任何新的网络/文件操作
自动化集成
添加到您的技能安装工作流程中：
python
import subprocess
import sys
def safeinstallskill(skill_path):
# 运行安全扫描
result = subprocess.run(
[python, scripts/securityscanner.py, skillpath, --format, json],
capture_output=True,
text=True
)
import json
report = json.loads(result.stdout)
if report[summary][verdict] == REJECT:
print(❌ 安装被阻止：发现严重安全问题)
return False
if report[summary][verdict] == WARNING:
response = input(⚠️ 检测到高风险模式。是否仍要安装？(y/N): )
if response.lower() != y:
return False
# 继续安装
return True
处理误报
某些合法技能可能触发警告：
- - 网络请求：从API获取数据的技能
- 文件操作：修改文档的技能
- 加密：处理敏感数据的技能
当您信任来源并理解功能时，可以：
- 1. 审查被标记的具体代码
- 验证其与文档描述的目的相符
- 如有信心，手动批准
报告问题
如果您发现确认具有恶意意图的技能：
- 1. 请勿安装或运行它
- 向技能仓库/托管平台报告
- 通知OpenClaw社区渠道
- 分享扫描报告（不执行该技能）
最佳实践
- 1. 仅从可信来源安装技能
- 安装前始终进行扫描 - 即使来自可信来源
- 仔细审查发现 - 了解技能的功能
- 保持扫描器更新 - 定期添加新的检测规则
- 对不受信任的来源使用严格模式 - 捕获更多可疑模式
- 检查技能更新 - 更新现有技能时重新扫描
退出代码
扫描器返回特定的退出代码：
警告 - 发现高风险模式 |
| 2 | 拒绝 - 检测到严重威胁 |
在脚本中使用：
bash
python scripts/security_scanner.py ./skill || {
echo 安全检查失败
exit 1
}
