Zero2ai Security Audit

核心功能：自动或手动扫描Git提交、仓库及技能代码，检测高/中/低危敏感内容（如API密钥、绝对路径、node_modules等），按风险等级拦截操作。典型场景：Git提交/推送前、技能发布前合规检查，或临时扫描路径排查风险。通过命令行调用，输入扫描参数，输出结果与退出码，高危直接拦截，中危需修复后发布，低危需复核，保障代码安全。

zero2ai-hub

热度 81.18

最近更新 2026-05-11 17:27:50

分类：安全依赖：代码执行应用场景：DevOps / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add zero2ai-security-audit

Metadata

name: zero2ai-security-audit
description: Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure.

Security Audit

Run scripts/audit.py before every commit, push, or skill publish. No exceptions.

When to run

Trigger	Command
Before `git commit`	`python3 {skill_dir}/scripts/audit.py --staged`
Before `git push`	`python3 {skill_dir}/scripts/audit.py --last-commit`
Before `clawhub publish <path>`	`python3 {skill_dir}/scripts/audit.py <skill_path>`
Ad-hoc scan any path	`python3 {skill_dir}/scripts/audit.py <path>`

{skill_dir} = /home/aladdin/.openclaw/workspace/skills/skill-security-audit

Exit codes

0 = clean
1 = HIGH or MEDIUM findings (block publish/push)
2 = usage error

What it detects

Severity	Pattern
🔴 HIGH	API keys, secrets, passwords, JWT tokens, WooCommerce keys, AWS keys, private key blocks, bearer tokens, `.env` files
🟡 MEDIUM	Absolute `/home/<user>/` paths, `/root/` paths, refresh tokens, `node_modules/` committed
🔵 LOW	Hardcoded IPs, long base64 strings

Rules

HIGH findings = hard block. Never commit or publish with HIGH findings. Rotate any exposed secret immediately.
MEDIUM findings = fix before publish. Replace absolute paths with relative or env-var defaults. Remove node_modules/.
LOW findings = review. Not blocking but investigate.
False positives: If a match is a variable name or safe placeholder (not an actual value), document why it's safe in a comment and re-run.

After finding a real secret

Do NOT push the commit. If already pushed: rotate the secret immediately, then rewrite history or delete the file from git.
Rotate in the provider portal (TikTok Dev, AWS IAM, WooCommerce, etc.)
Move to env var: process.env.SECRET_NAME or read from a local config file outside the repo.
Add the config file path to .gitignore.
Report to Aladdin immediately with severity and what was exposed.

Skill publish checklist

Before clawhub publish:

audit.py <skill_path> returns 0 (clean)
node_modules/ not present in skill folder
No absolute paths to user home directories
No hardcoded business-specific IDs or credentials
package.json name matches skill folder name
SKILL.md description updated if renamed