Evez Skill Vetter

通过 Python 脚本对技能目录或 ClawHub 技能做安装前安全审查，检查权限范围、可疑调用、数据外传、依赖风险、代码混淆与硬编码密钥，并输出 0-100 风险分与发现清单。材料中引用的 scripts/pull.py、scripts/run.sh 未出现在实际文件列表中。

evezart

热度 25.46

最近更新 2026-05-12 20:26:49

分类：安全依赖：代码执行 / 读写文件应用场景：代码审查 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add evez-skill-vetter

Metadata

name: evez-skill-vetter
description: Security review for OpenClaw skills before installation. Use when evaluating third-party skills for safety, checking permission scope, detecting suspicious patterns, identifying data exfiltration risks, or auditing skill code. Covers static analysis, permission auditing, dependency scanning, and risk scoring.

Skill Vetter

Review third-party skills before installing them. Catch security risks early.

Quick Start

python3 scripts/vet.py --skill /path/to/skill
python3 scripts/vet.py --slug some-skill  # vet a ClawHub skill

What It Checks

Permission scope — Does the skill request exec, network, or file access?
Suspicious patterns — eval(), exec(), subprocess, fetch to unknown hosts, encoded strings
Data exfiltration — Sending data to external endpoints, logging secrets
Dependency risks — Known vulnerable packages, excessive dependencies
Code quality — Minified/obfuscated code, missing SKILL.md, oversized files
Secret exposure — Hardcoded API keys, tokens, passwords in source

Risk Score

Each check produces a risk score 0-100:

0-20: ✅ Safe — install freely
21-50: ⚠️ Caution — review findings before installing
51-75: 🚨 Risky — significant security concerns
76-100: ❌ Dangerous — do not install

Output

SKILL: some-skill
RISK: 35/100 (Caution)
FINDINGS:
  ⚠️ Uses subprocess.call() in scripts/run.sh:3
  ⚠️ Fetches from https://unknown-api.com in scripts/pull.py:12
  ✅ No hardcoded secrets found
  ✅ SKILL.md present and valid