Scopecheck

核心功能：分析OpenClaw SKILL.md，提取环境变量、CLI工具、文件路径、网络URL等权限范围，对比声明需求与实际使用，标记未声明的访问风险。典型场景：检查Skill权限合规性，排查未披露的潜在风险。输入为SKILL.md内容，输出含声明权限、检测结果及未声明项的JSON，需通过API调用使用。

mirni

热度 42.25

最近更新 2026-05-11 17:42:41

分类：安全依赖：代码执行 / 读写文件应用场景：代码审查 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add scopecheck

Metadata

name: scopecheck
description: Analyze an OpenClaw SKILL.md and extract its permission scope — what env vars, CLI tools, filesystem paths, and network URLs it accesses. Compares declared requirements against actual usage and flags undeclared access.
metadata: {"openclaw":{"emoji":"🔬","requires":{"bins":["python"]},"install":[{"id":"pip","kind":"uv","packages":["fastapi","uvicorn","pydantic","pyyaml"]}]}}

ScopeCheck

Find out what a skill actually accesses vs what it claims to need.

Start the server

uvicorn scopecheck.app:app --port 8002

Check a skill's scope

curl -s -X POST http://localhost:8002/v1/check-scope \
  -H "Content-Type: application/json" \
  -d "{\"skill_content\": $(cat path/to/SKILL.md | jq -Rs)}" | jq

Returns declared (env vars and bins from metadata), detected (what the skill actually references), and undeclared_access (detected but not declared — potential risk).

What it extracts

env_vars — environment variables like $HOME, $API_KEY
cli_tools — binaries used in Run/Execute commands
filesystem_paths — /etc/hosts, ~/.ssh/config, etc.
network_urls — any http/https URLs referenced

Undeclared access format

Each undeclared item is prefixed with its type: env:SECRET_KEY, bin:curl, fs:/etc/passwd, net:https://example.com.