360 Secure SkillHub
360 安全技能中心

Aura Security Scanner

该 Skill 让使用者提交待安装 Skill 的链接，调用 AURA Security API 检测恶意代码、凭据窃取、提示注入、过度权限与混淆执行等风险，并返回 SAFE/WARNING/DANGEROUS/BLOCKED 判定、风险评分与处理建议。自身不实现扫描引擎，仅做 API 调用与结果呈现。

aurasecurity-creator
aurasecurity-creator
热度 84.65
最近更新 2026-05-11 15:54:29
分类：安全依赖：第三方 API应用场景：代码审查 / API 集成 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add aura-security-scanner
Metadata
name
AURA Security Scanner
description
Scan AI agent skills for malware, credential theft, prompt injection, and dangerous permissions before installing them
version
1.0.0
requires
{"bins":[],"env":["AURA_API_URL"],"config":[]}
permissions
{"filesystem":[],"network":["api.aurasecurity.io"],"exec":[]}
tags
["security","malware-detection","skill-scanner","trust"]

AURA Security Scanner

Protect your AI agent from malicious skills. Scan any OpenClaw, Claude MCP, or LangChain skill before installation.

What It Detects

  • Malware Patterns - Credential theft, file exfiltration, crypto miners, backdoors
  • Prompt Injection - Attempts to override system instructions or jailbreak agents
  • Permission Issues - Overly broad filesystem, network, or execution permissions
  • Suspicious Networks - Connections to known exfiltration domains (webhook.site, etc.)
  • Obfuscated Code - Base64/hex encoded execution, dynamic eval patterns

Usage

Ask me to scan a skill before you install it:

"Scan this skill for security issues: https://github.com/user/cool-skill"

"Is this skill safe? https://github.com/example/mcp-tool"

"Check https://clawhub.xyz/skill/weather-api for malware"

Verdicts

Verdict Risk Score Meaning
SAFE 0-20 No issues found, safe to install
WARNING 21-50 Minor concerns, review before installing
DANGEROUS 51-80 Significant risks detected, avoid
BLOCKED 81-100 Critical threats, do not install

AURA Verified Badge

Skills with a SAFE verdict can display the AURA Verified badge, showing users they've been scanned and approved.

Examples

Safe Skill Response

AURA Skill Scan: weather-api

Verdict: SAFE
Risk Score: 5/100
AURA Verified: Yes

Summary: Clean skill with minimal permissions.
Requests only weather API access.

Recommendation: Safe to install.

Dangerous Skill Response

AURA Skill Scan: suspicious-helper

Verdict: DANGEROUS
Risk Score: 78/100
AURA Verified: No

Findings:
- CRITICAL: Accesses SSH keys (~/.ssh/id_rsa)
- HIGH: Sends data to webhook.site
- HIGH: Runs eval() on decoded base64

Recommendation: Do not install. Contains credential
theft and data exfiltration patterns.

API

This skill calls the AURA Security API:

POST https://api.aurasecurity.io/scan-skill
{
  "skillUrl": "https://github.com/user/skill",
  "format": "auto",
  "includeRepoTrust": true
}

About AURA

AURA (Agent Universal Reputation & Assurance) provides security infrastructure for the AI agent ecosystem. We verify skills, track agent reputation, and protect users from malicious code.