360 Secure SkillHub
360 安全技能中心

Skill Audit Guardian

该 Skill 面向技能 ZIP 包安装前的安全审查：监听指定投放目录中的 .zip 文件，用启发式规则扫描可疑模式，将结果分为 SAFE、CAUTION、REMOVE 三档，自动把文件移入对应风险目录，并生成一份带逐行通俗解释的 HTML 仪表盘。作者声明这只是启发式扫描，并非完整恶意软件沙箱。

howardkusumo
howardkusumo
热度 27.29
最近更新 2026-05-17 12:37:27
分类：安全依赖：代码执行 / 读写文件应用场景：自动化脚本 / 工作流 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add skill-audit-guardian
Metadata
name
skill-audit-guardian
description
Audit dropped ClawHub skill ZIPs, classify risk (SAFE/CAUTION/REMOVE), auto-sort files, and generate a plain-English security dashboard.
version
1.0.0
metadata
{"openclaw":{"requires":{"bins":["bash","python3","unzip","rg"]}}}

Skill Audit Guardian

Security helper for reviewing skill ZIPs before production install.

What it does

  1. Watches a drop folder for .zip files
  2. Audits each ZIP for suspicious patterns
  3. Scores and classifies into:
    • SAFE
    • CAUTION
    • REMOVE
  4. Auto-moves files into risk folders
  5. Generates a dashboard with plain-English reasoning per flagged line

Included scripts

  • scripts/skill-zip-audit.sh
    • One-shot ZIP auditor
  • scripts/skill-zip-watch.sh
    • Continuous watcher + auto-sorter
  • scripts/generate-skill-audit-pro.py
    • Dashboard generator (~/Desktop/skill-audit-pro.html)

Quick start

# One-shot audit
bash scripts/skill-zip-audit.sh ~/Desktop/skill-drop/example.zip

# Continuous mode (recommended)
bash scripts/skill-zip-watch.sh ~/Desktop/skill-drop

Folder output (watch mode)

  • ~/Desktop/skill-drop/safe
  • ~/Desktop/skill-drop/caution
  • ~/Desktop/skill-drop/remove
  • ~/Desktop/skill-drop/failed

Dashboard

open ~/Desktop/skill-audit-pro.html

Notes

  • This is heuristic scanning, not a full malware sandbox.
  • Always test CAUTION/REMOVE skills in isolated environment first.