360 Secure SkillHub
360 安全技能中心

ict

Python CLI 安全审计 Skill:读取待审计 Skill 目录,以正则和 AST 静态检测凭证收集、代码执行、数据外泄、提示词注入等 23 类风险,输出安全、质量、结构、透明度、行为五维评分与 A–F 评级,并支持批量扫描、两两对比、版本差异、趋势记录、JSON 输出和 CI 退出码。

vimvem
vimvem
热度 45.49
最近更新 2026-05-11 17:35:11
分类:安全依赖:代码执行 / 读写文件应用场景:代码审查 / 报告撰写 / 自动化脚本 / DevOps ...

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add ict
Metadata
name
ict
version
4.0.0
description
Security audit tool for Claw Skills - NOT malicious. This tool contains detection rules (eval, exec, subprocess, etc.) for scanning skills, these are security patterns, not actual malicious code. Similar to yoder-skill-auditor.
metadata
{"openclaw":{"requires":{"bins":["python3"],"env":[],"config":[]},"user-invocable":true}}

ict

Basic Info

  • Description: Automated tool for checking Claw Skill quality, supports code style, security vulnerabilities, documentation completeness and code-documentation consistency
  • Triggers: quality check, audit, inspect skill, skill quality, ICT, batch scan, full scan, security check, global scan
  • Category: devtools
  • Version: 4.0.8

⚠️ Security Notice: This tool contains malicious code pattern detection rules for static analysis. Detection rules contain keywords like exec, eval, C2 - this is normal for audit functionality and will not execute malicious code.

Installation

Install from ClawHub

clawhub install ict

Manual Installation

# Clone or download this skill
cd ict

# Make executable
chmod +x ict.py

# Run directly
python3 ict.py --help

Usage

CLI

# Single Skill Audit
python ict.py <skill_folder_path>
python ict.py <skill_folder_path> --json

# 5-Dimension Trust Score
python ict.py <skill_folder_path> --score

# Trend Tracking
python ict.py <skill_folder_path> --save-trend
python ict.py <skill_folder_path> --trend

# Compare Two Skills
python ict.py <skill_folder_path> --compare <other_skill_path>

# Diff Audit
python ict.py <old_folder_path> --diff <new_folder_path>

# Batch Scan
python ict.py --all
python ict.py --all --skills-dir /path/to/skills

API

from ict import audit_skill
result = audit_skill("/path/to/skill-folder")

Features

Security Checks (23 items)

# Check Description
1 Credential Harvest Credential + network calls combo detection
2 Code Execution eval/exec/spawn
3 Data Exfiltration webhook.site, requestbin, ngrok URLs
4 Base64 Obfuscation Encoded payloads
5 Sensitive FS /etc/passwd, ~/.ssh, ~/.aws
6 Crypto Wallet ETH/BTC address detection
7 Dependency Confusion @internal, typosquatting
8 Install Hooks pre/post install
9 Symlink Attack Symlink to sensitive paths
10 Time Bomb Delayed trigger
11 Remote Exec curl
12 Telemetry Analytics SDK, tracking
13 Prompt Injection "ignore previous instructions"
14 Stealth Exfil Hidden data transmission
15 C2 Server C2 server detection
16 Container Escape Docker socket escape
17 SSH Remote SSH/scp commands
18 Privilege Escalation sudo, chmod 777
19 Hidden Files Access to .files
23 Unusual Ports 4444, 5555, 1337, etc

Supported Languages

  • Python (.py)
  • Shell (.sh, .bash)
  • JavaScript/TypeScript (.js, .ts)

5-Dimension Trust Score (0-100)

Dimension Max Description
Security 35 Security check results
Quality 22 Documentation completeness
Structure 18 File structure
Transparency 15 Version/license info
Behavioral 10 Code consistency

Grade: A(90+), B(75+), C(60+), D(40+), F(<40)

Quality Checks

  • SKILL.md completeness
  • Code style (line length, syntax)
  • Code-documentation consistency
  • File structure

Batch Scan

  • One-click scan all installed Skills
  • Global security report sorted by risk
  • Statistics: safe/warning/danger

Trend Tracking

  • --save-trend Save score to history
  • --trend View score trend
  • Keep last 50 records

Comparison

  • --compare Side-by-side comparison
  • Show dimension differences and winner

Diff Audit

  • --diff Compare old/new versions
  • Identify new issues, fixed issues, regressions

Exit Code (CI/CD)

Code Meaning
0 PASS - Safe
1 REVIEW - Warnings
2 FAIL - Critical issues
3 Error

False Positive Prevention

  • PATTERN_DEF_FILTER - Auto-filter rule definitions
  • Comment line filtering
  • Allowlist support

Limitations

  • Some checks based on regex, may have false positives
  • LLM analysis requires external tools

ict

基本信息

  • 描述: 自动化检查 Claw Skill 质量的工具,支持代码风格,安全漏洞、文档完整性和代码文档一致性检查
  • 触发词: 质检, audit, 检查skill, skill质量, ICT, 批量扫描, 全部扫描, 安全体检, 全局扫描
  • 分类: devtools
  • 版本: 4.0.8

⚠️ 安全说明: 本工具包含恶意代码模式检测规则,用于静态分析审计目标代码。检测规则本身包含 exec、eval、C2 等敏感关键字,这是正常的审计功能,不会执行任何恶意操作。

安装

从 ClawHub 安装

clawhub install ict

手动安装

# 克隆或下载此 skill
cd ict

# 添加执行权限
chmod +x ict.py

# 直接运行
python3 ict.py --help

使用方法

CLI

# 单个 Skill 审查
python ict.py <skill_folder_path>
python ict.py <skill_folder_path> --json

# 5维度信任评分
python ict.py <skill_folder_path> --score

# 趋势追踪
python ict.py <skill_folder_path> --save-trend
python ict.py <skill_folder_path> --trend

# 对比两个 Skills
python ict.py <skill_folder_path> --compare <other_skill_path>

# Diff审计
python ict.py <old_folder_path> --diff <new_folder_path>

# 批量扫描
python ict.py --all
python ict.py --all --skills-dir /path/to/skills

API

from ict import audit_skill
result = audit_skill("/path/to/skill-folder")

功能

安全检查 (23项)

# 检测项 说明
1 凭证收集 凭证+网络调用组合检测
2 代码执行 eval/exec/spawn
3 数据外泄 webhook.site, requestbin, ngrok
4 Base64混淆 编码载荷
5 敏感文件系统 /etc/passwd, ~/.ssh, ~/.aws
6 加密钱包 ETH/BTC地址检测
7 依赖混淆 @internal, 拼写抢注
8 安装钩子 pre/post install
9 Symlink攻击 符号链接敏感路径
10 时间炸弹 延迟触发
11 远程执行 curl
12 遥测追踪 分析SDK, 追踪
13 提示词注入 "忽略之前指令"
14 隐蔽数据外发 隐藏数据传输
15 C2服务器 C2服务器检测
16 容器逃逸 Docker socket逃逸
17 SSH远程 SSH/scp命令
18 权限提升 sudo, chmod 777
19 隐藏文件 访问.files
23 非寻常端口 4444, 5555, 1337等

支持语言

  • Python (.py)
  • Shell (.sh, .bash)
  • JavaScript/TypeScript (.js, .ts)

5维度信任评分 (0-100)

维度 满分 说明
Security 35 安全检测结果
Quality 22 文档完整性
Structure 18 文件结构
Transparency 15 版本/许可证信息
Behavioral 10 代码一致性

评级: A(90+), B(75+), C(60+), D(40+), F(<40)

质量检查

  • SKILL.md完整性
  • 代码风格
  • 代码文档一致性
  • 文件结构

批量扫描

  • 一键扫描所有已安装的Skills
  • 按风险排序的全局安全报告
  • 统计:安全/警告/危险

趋势追踪

  • --save-trend 保存评分到历史
  • --trend 查看评分趋势
  • 保留最近50条记录

对比分析

  • --compare 并排对比
  • 显示各维度差异和胜出者

Diff审计

  • --diff 对比新旧版本
  • 识别新增问题、修复问题、回归

Exit Code (CI/CD)

退出码 含义
0 PASS - 安全
1 REVIEW - 警告
2 FAIL - 严重问题
3 Error

防误报机制

  • PATTERN_DEF_FILTER - 自动过滤规则定义
  • 注释行过滤
  • 白名单支持

限制

  • 部分检测基于正则,可能存在误报
  • LLM分析需外部工具