skill-trust-auditor

结合 OpenClaw 注册表验证与本地有界静态分析，对指定 ClawHub Skill 做安装前安全审计，输出信任评分、风险等级、可疑模式位置与处理建议，并声明结果仅为启发式证据，不代替用户授权安装。

jonathanjing

热度 62.49

最近更新 2026-08-04 00:58:48

分类：安全依赖：代码执行 / 读写文件 / 第三方 API / 内部调用大模型应用场景：代码审查 / 报告撰写 / 工作流 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add skill-trust-auditor

Metadata

name: skill-trust-auditor
description: Audit a named ClawHub skill or skill URL before installation by combining OpenClaw verification with bounded static analysis. Use when the user explicitly asks whether a skill is safe or requests a pre-install review; report evidence and uncertainty instead of treating a score as proof.
metadata: {"openclaw":{"version":"1.1.5","emoji":"🛡️","homepage":"https://clawhub.ai/jonathanjing/skill-trust-auditor","requires":{"bins":["python3"]},"envVars":[{"name":"ANTHROPIC_API_KEY","required":false,"description":"Optional LLM judge credential for ambiguous findings."}]}}

Skill Trust Auditor

Audit any ClawHub skill for security risks before installation.

🛠️ Installation

1. Ask OpenClaw (Recommended)

Tell OpenClaw: "Install @jonathanjing/skill-trust-auditor."

2. Manual Installation (CLI)

If you prefer the terminal, run:

openclaw skills install @jonathanjing/skill-trust-auditor

Setup (first run only)

bash "{baseDir}/scripts/setup.sh"

Audit a Skill

First request the registry trust envelope:

openclaw skills verify @owner/skill --json

Then run bounded local analysis when the user asks for a deeper audit:

bash "{baseDir}/scripts/audit.sh" [skill-name-or-url]
# Example:
bash "{baseDir}/scripts/audit.sh" steipete/clawhub
bash "{baseDir}/scripts/audit.sh" https://clawhub.ai/someuser/someskill

Output:

{
  "skill": "someuser/someskill",
  "trust_score": 72,
  "verdict": "INSTALL WITH CAUTION",
  "risks": [
    {"level": "HIGH", "pattern": "curl to external domain", "location": "scripts/sync.sh:14"},
    {"level": "MEDIUM", "pattern": "reads MEMORY.md", "location": "SKILL.md:23"}
  ],
  "safe_patterns": ["no env var access", "no self-modification"],
  "author_verified": false,
  "recommendation": "Review scripts/sync.sh:14 before installing. The external curl call could exfiltrate data."
}

Post to user with clear summary:

🛡️ Trust Audit: someuser/someskill
Score: 72/100 — ⚠️ INSTALL WITH CAUTION

🔴 HIGH: curl to unknown domain in scripts/sync.sh:14
🟡 MEDIUM: reads your MEMORY.md

Recommendation: Inspect line 14 of sync.sh before proceeding.
Inspect the exact version's Files tab or installed folder before proceeding.

Trust Score Guide

Score	Verdict	Action
90-100	✅ SAFE	Install freely
70-89	⚠️ CAUTION	Review flagged items first
50-69	🟠 RISKY	Only if you understand the risks
0-49	🔴 DO NOT INSTALL	High probability of malicious intent

Risk Pattern Reference

HIGH RISK (-30 each):

process.env access in scripts
curl/wget to non-standard domains
Reading ~/.config or ~/.openclaw directly
exec() with user-controlled input
Instructions to modify SOUL.md/AGENTS.md/openclaw.json

MEDIUM RISK (-10 each):

Any outbound API calls (even to known services)
File writes outside workspace
Reading MEMORY.md or diary files

LOW RISK (-3 each):

web_fetch to standard domains
Read-only file access in workspace

Do not auto-install from an audit score. Present findings, the registry decision, and the exact install reference; let the user authorize installation separately.

ClawHavoc Pattern Reference

See {baseDir}/references/clawhavoc-patterns.md for known malicious patterns. Treat it as a heuristic reference, not a complete malware signature set.