{"id":"2b4a8b55-00fa-45e2-b2de-3feb59339e08","entityType":"agent","slug":"clawhub-cyzlmh-cmic-skill-scanner-linux-amd64","name":"CMIC Skill Scanner (Linux x64)","canonicalUrl":"https://www.xpersona.co/agent/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64","canonicalPath":"/agent/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64","generatedAt":"2026-10-10T11:51:24.416Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":null},"description":"使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 1.5K downloads reported by the source. Last updated 10/10/2026.","installCommand":"clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-amd64","sourceUrl":"https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-amd64","homepage":"https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-amd64","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-amd64","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-amd64","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":64,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"CMIC Skill Scanner (Linux x64) technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":null},"stars":null,"forks":null,"downloads":1538,"packageName":null,"latestVersion":"0.11.1","tractionLabel":"1.5K downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T09:05:35.069Z","emptyReason":null},"lastUpdatedAt":"2026-10-10T09:05:35.070Z","lastCrawledAt":"2026-10-10T09:05:35.069Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-11T09:05:35.069Z","lastVerifiedAt":null,"highlights":[{"version":"0.11.1","createdAt":"2026-07-27T06:43:04.167Z","changelog":"- Updated included binary to version v0.11.1 (Linux x64) with new SHA-256 hash. - Refreshed SKILL.md to reflect the new binary version and checksum. - Removed obsolete skill-card.md file. - Minor documentation and build info updates.","fileCount":6,"zipByteSize":6616},{"version":"0.11.0","createdAt":"2026-07-14T08:42:31.214Z","changelog":"**0.11.0 introduces optional LLM review and dynamic engine selection.** - Added support for LLM-based semantic analysis (`--use-llm`), configurable per scan. - New `auto` engine mode automatically prefers external scanners, falling back to native if unavailable. - Updated workflow and trust boundaries documentation: clarified scan behavior, LLM integration, and network features. - Binary version bumped to v0.11.0 and checksum updated. - Removed `skill-card.md` as part of documentation reorganization.","fileCount":6,"zipByteSize":6269},{"version":"0.9.0","createdAt":"2026-05-28T10:04:24.019Z","changelog":"- Updated bundled scanner binary to version v0.9.0 (from v0.8.0) - Documentation (SKILL.md) updated to reflect new binary version - SHA-256 checksum for the scanner binary remains unchanged","fileCount":6,"zipByteSize":4684},{"version":"0.8.0","createdAt":"2026-04-21T17:32:10.938Z","changelog":"- Rebranded from \"cmic-skill-scanner\" to \"skillscan-wrapper\" with updated descriptions and metadata. - Documentation overhaul: clearer instructions, detailed trust and security warnings, multilingual content. - Emphasized that upload/reporting and external engine integrations are disabled by default and require explicit user configuration. - Updated references to binary version (`v0.8.0`), with consistent SHA-256 and security verification steps. - Clarified tool permissions, trust model, and provided more explicit build-from-source guidance.","fileCount":5,"zipByteSize":3443},{"version":"0.6.4","createdAt":"2026-04-21T10:05:42.466Z","changelog":"- Updated to version 0.6.4 with corresponding documentation changes. - Clarified that the scanner analyzes only skill source code and does not access your system files or credentials. - Updated binary version references and SHA-256 in documentation. - Improved description of detected suspicious patterns within skills. - Removed local-file-read permission requirement from metadata.","fileCount":5,"zipByteSize":2688},{"version":"0.6.3","createdAt":"2026-04-21T09:37:18.990Z","changelog":"- Updated version to 0.6.3 with revised documentation for improved clarity. - Repository and author links now point to https://gitee.com/random_player/cmic-skill-scanner. - Added a \"permissions\" section, listing required and non-required permissions. - Reformatted binary information, usage instructions, and malware detection details for better readability. - Updated links to releases, source, and checksum files.","fileCount":5,"zipByteSize":2674},{"version":"0.6.2","createdAt":"2026-04-21T08:42:48.712Z","changelog":"- Updated to version 0.6.2 with revised descriptions for clarity. - Added link to public source code repository and clarified open source status. - Improved documentation: specified included binary version, platform, and hash, and added instructions to verify the binary. - Expanded list of security checks and streamlined usage examples. - Updated metadata with repository URL and reduced tag list.","fileCount":5,"zipByteSize":2396},{"version":"0.6.1","createdAt":"2026-04-21T08:20:28.669Z","changelog":"- Updated to version 0.6.1 with revised SKILL.md content and metadata. - Added detailed metadata including author, tags, and triggers for easier discovery and activation. - Improved skill documentation for clarity, including new usage examples and output descriptions. - License updated from MIT to MIT-0. - Path and version references updated for the included binary.","fileCount":5,"zipByteSize":2440}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-amd64","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-amd64` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-amd64 before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-10T11:51:24.415Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-amd64/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":null},"readme":"Skill: CMIC Skill Scanner (Linux x64)\n\nOwner: cyzlmh\n\nSummary: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\n\nTags: latest:0.11.1\n\nVersion history:\n\nv0.11.1 | 2026-07-27T06:43:04.167Z | auto\n\n- Updated included binary to version v0.11.1 (Linux x64) with new SHA-256 hash.\n- Refreshed SKILL.md to reflect the new binary version and checksum.\n- Removed obsolete skill-card.md file.\n- Minor documentation and build info updates.\n\nv0.11.0 | 2026-07-14T08:42:31.214Z | auto\n\n**0.11.0 introduces optional LLM review and dynamic engine selection.**\n\n- Added support for LLM-based semantic analysis (`--use-llm`), configurable per scan.\n- New `auto` engine mode automatically prefers external scanners, falling back to native if unavailable.\n- Updated workflow and trust boundaries documentation: clarified scan behavior, LLM integration, and network features.\n- Binary version bumped to v0.11.0 and checksum updated.\n- Removed `skill-card.md` as part of documentation reorganization.\n\nv0.9.0 | 2026-05-28T10:04:24.019Z | auto\n\n- Updated bundled scanner binary to version v0.9.0 (from v0.8.0)\n- Documentation (SKILL.md) updated to reflect new binary version\n- SHA-256 checksum for the scanner binary remains unchanged\n\nv0.8.0 | 2026-04-21T17:32:10.938Z | auto\n\n- Rebranded from \"cmic-skill-scanner\" to \"skillscan-wrapper\" with updated descriptions and metadata.\n- Documentation overhaul: clearer instructions, detailed trust and security warnings, multilingual content.\n- Emphasized that upload/reporting and external engine integrations are disabled by default and require explicit user configuration.\n- Updated references to binary version (`v0.8.0`), with consistent SHA-256 and security verification steps.\n- Clarified tool permissions, trust model, and provided more explicit build-from-source guidance.\n\nv0.6.4 | 2026-04-21T10:05:42.466Z | auto\n\n- Updated to version 0.6.4 with corresponding documentation changes.\n- Clarified that the scanner analyzes only skill source code and does not access your system files or credentials.\n- Updated binary version references and SHA-256 in documentation.\n- Improved description of detected suspicious patterns within skills.\n- Removed local-file-read permission requirement from metadata.\n\nv0.6.3 | 2026-04-21T09:37:18.990Z | auto\n\n- Updated version to 0.6.3 with revised documentation for improved clarity.\n- Repository and author links now point to https://gitee.com/random_player/cmic-skill-scanner.\n- Added a \"permissions\" section, listing required and non-required permissions.\n- Reformatted binary information, usage instructions, and malware detection details for better readability.\n- Updated links to releases, source, and checksum files.\n\nv0.6.2 | 2026-04-21T08:42:48.712Z | auto\n\n- Updated to version 0.6.2 with revised descriptions for clarity.\n- Added link to public source code repository and clarified open source status.\n- Improved documentation: specified included binary version, platform, and hash, and added instructions to verify the binary.\n- Expanded list of security checks and streamlined usage examples.\n- Updated metadata with repository URL and reduced tag list.\n\nv0.6.1 | 2026-04-21T08:20:28.669Z | auto\n\n- Updated to version 0.6.1 with revised SKILL.md content and metadata.\n- Added detailed metadata including author, tags, and triggers for easier discovery and activation.\n- Improved skill documentation for clarity, including new usage examples and output descriptions.\n- License updated from MIT to MIT-0.\n- Path and version references updated for the included binary.\n\nv0.6.0 | 2026-04-21T07:54:00.108Z | auto\n\n- Renamed skill to \"cmic-skill-scanner\" and updated skill description for improved clarity.\n- Updated embedded binary version to v0.6.0.\n- Documentation now emphasizes security scanning before skill installation and details threats (malware, credential theft, suspicious patterns).\n- No external downloader required; package is fully self-contained.\n- Minor language and clarity improvements throughout documentation.\n\nv0.5.0 | 2026-04-21T07:13:54.503Z | auto\n\n- Updated engine binary to version v0.5.0, with SHA-256 checksum preserved.\n- SKILL.md significantly rewritten and simplified; now primarily in Chinese and focused on usage guidance and workflows.\n- Clarified usage of optional external scanner (`--engine external/auto`) and details on input requirements.\n- Instructions for enterprise integration improved: upload/reporting process and expected outputs are clearly described.\n- Old metadata, feature lists, and detailed security guarantee sections removed for brevity.\n\nv0.2.0 | 2026-04-21T05:13:27.577Z | auto\n\n- Introduces cmic-skill-scanner version 0.2.0 for Linux (x64), a defensive security tool to scan AI agent skill packages for malware, credential theft, and suspicious patterns before installation.\n- Includes a native Rust binary scanner (no external downloads required) with SHA-256 checksum for integrity verification.\n- Clearly documents strict security boundaries: does not access personal credentials or send data unless explicitly commanded by the user; no elevated permissions required.\n- Adds optional enterprise reporting and support for external scanner engines, both user-controlled via command-line options.\n- Provides detailed usage instructions, batch and single skill scanning, report options, and a summary of 31 built-in detection rules.\n- Source code and build transparency available for independent verification; alternative platforms (macOS ARM, Linux ARM) referenced.\n\nArchive index:\n\nArchive v0.11.1: 6 files, 6616 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (219b), INSTALL.md (3205b), skill-card.md (2285b), SKILL.md (5602b), _meta.json (150b)\n\nFile v0.11.1:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.1` |\n| Platform | `Linux x64` |\n| SHA-256 | `bb3847f3afca734ef0cf6c061f553602b3df5dad23f726215d25812b74d01bf0` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit `--use-llm` and works with `native`, `external`, and `auto`.\n\n```bash\nskillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model\n```\n\nWith `native`, the endpoint receives static-finding summaries and up to 24 text files from the target package (up to 8 KiB each and 64 KiB total). Lines named `api_key`, `token`, `password`, `secret`, or `authorization` are redacted at a basic level. This is not a guarantee that all sensitive text is removed: use only a trusted endpoint and confirm the data-handling policy.\n\nWith a Cisco-compatible `external` engine, CMIC adds `--use-llm` and passes endpoint, model, and optional key to the child process through `SKILL_SCANNER_LLM_*` variables; the external scanner controls its own packet, redaction, and failure behavior. `auto` tries that external LLM first and falls back to native if the external process fails. API keys are never written to the scan command or report.\n\nIf the native LLM request fails, the native static result is still returned and `engine.fallback_reason` records the reason.\n\n## 外部引擎集成\n\nDefault `auto` mode tries a locally resolved external scanner first and falls back to native when it is unavailable or fails. Use `--engine external` to require the external result, or `--engine native` to run only the built-in engine.\n\nCMIC passes the target path to a user-configured local tool. The tool runs with the current user's process permissions; trust the external tool and its configuration separately. CMIC only configures the external LLM endpoint when `--use-llm` is explicitly set; the tool may otherwise bootstrap dependencies or use its own network configuration.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary / external tool | To run the selected scanner engine; `auto` may invoke a locally resolved external scanner |\n| Network (optional) | `--upload-url` sends a JSON report; native `--use-llm` sends a bounded text packet; external `--use-llm` follows the external tool's data policy |\n\nFile v0.11.1:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.11.1\",\n  \"publishedAt\": 1785134584167\n}\n\nFile v0.11.1:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Linux glibc Compatibility\n\nThere are two x86_64 Linux builds. Pick the right one **before** downloading:\n\n| Package | Target systems | Requirement |\n|---------|---------------|-------------|\n| `linux-amd64` | Ubuntu 20.04+, Debian 11+, RHEL 9+, Fedora 31+ | glibc >= 2.30 |\n| `bclinux21-amd64` | BCLinux 21/8.2, CentOS 7/8, RHEL 7/8, Amazon Linux 2 | none (static musl) |\n\nCheck your glibc version first:\n\n```bash\nldd --version | head -1          # glibc < 2.30  -> use bclinux21-amd64\ncat /etc/os-release | grep -i \"bclinux\\|bigcloud\"   # matches -> use bclinux21-amd64\n```\n\nIf you run `linux-amd64` and see `version 'GLIBC_2.30' not found` (or similar),\nyour glibc is too old — switch to the `bclinux21-amd64` package, which is\nstatically linked with musl and does not depend on the system glibc.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark --engine native\n./assets/bin/skillscan package-skill\n```\n\nFile v0.11.1:skill-card.md\n\n## Description:\n\nAudits local skill packages or archives with auto, native, or external scanner engines and can optionally enable LLM semantic review.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[cyzlmh](https://clawhub.ai/user/cyzlmh)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and engineers use this skill to run a local security review before installing a skill package, archive, or release bundle. It helps summarize scanner engine status, findings, risk level, and installation guidance.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The release evidence says the packaged binary and checksum are missing, so the claimed bundled binary should not be trusted without verification.\n\nMitigation: Confirm the package contains the expected binary and checksum before running it; verify the SHA-256 value or build from source.\n\nRisk: Default auto mode may run a locally resolved external scanner with the current user's permissions.\n\nMitigation: Use --engine native unless the resolved external scanner and its configuration are trusted.\n\nRisk: Optional LLM review or report upload can send scan data to configured endpoints.\n\nMitigation: Enable --use-llm or --upload-url only with endpoints you control and whose data-handling behavior is understood.\n\n## Reference(s):\n\n- [CMIC Skill Scanner ClawHub Page](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-amd64)\n- [CMIC Skill Scanner source repository referenced by package documentation](https://gitee.com/random_player/cmic-skill-scanner.git)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Configuration, Guidance]\n\n**Output Format:** [Markdown guidance with command examples and optional JSON or Markdown scan reports]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May write scan reports to a user-specified output directory.]\n\n## Skill Version(s):\n\n0.11.1 (source: server release metadata and assets/build/build-info.json)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v0.11.1:assets/build/build-info.json\n\n{\n  \"version\": \"v0.11.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1785134501,\n  \"checksum\": \"bb3847f3afca734ef0cf6c061f553602b3df5dad23f726215d25812b74d01bf0\"\n}\n\nFile v0.11.1:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.11.0: 6 files, 6269 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (219b), INSTALL.md (2400b), skill-card.md (2567b), SKILL.md (5602b), _meta.json (150b)\n\nFile v0.11.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.0` |\n| Platform | `Linux x64` |\n| SHA-256 | `d29272d8ac33afc18df3ecda2461a1568192ca61b3aeb0044dba3ab687c00d08` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit `--use-llm` and works with `native`, `external`, and `auto`.\n\n```bash\nskillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model\n```\n\nWith `native`, the endpoint receives static-finding summaries and up to 24 text files from the target package (up to 8 KiB each and 64 KiB total). Lines named `api_key`, `token`, `password`, `secret`, or `authorization` are redacted at a basic level. This is not a guarantee that all sensitive text is removed: use only a trusted endpoint and confirm the data-handling policy.\n\nWith a Cisco-compatible `external` engine, CMIC adds `--use-llm` and passes endpoint, model, and optional key to the child process through `SKILL_SCANNER_LLM_*` variables; the external scanner controls its own packet, redaction, and failure behavior. `auto` tries that external LLM first and falls back to native if the external process fails. API keys are never written to the scan command or report.\n\nIf the native LLM request fails, the native static result is still returned and `engine.fallback_reason` records the reason.\n\n## 外部引擎集成\n\nDefault `auto` mode tries a locally resolved external scanner first and falls back to native when it is unavailable or fails. Use `--engine external` to require the external result, or `--engine native` to run only the built-in engine.\n\nCMIC passes the target path to a user-configured local tool. The tool runs with the current user's process permissions; trust the external tool and its configuration separately. CMIC only configures the external LLM endpoint when `--use-llm` is explicitly set; the tool may otherwise bootstrap dependencies or use its own network configuration.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary / external tool | To run the selected scanner engine; `auto` may invoke a locally resolved external scanner |\n| Network (optional) | `--upload-url` sends a JSON report; native `--use-llm` sends a bounded text packet; external `--use-llm` follows the external tool's data policy |\n\nFile v0.11.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.11.0\",\n  \"publishedAt\": 1784018551214\n}\n\nFile v0.11.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark --engine native\n./assets/bin/skillscan package-skill\n```\n\nFile v0.11.0:skill-card.md\n\n## Description: <br>\nAudits local skill packages or archives with auto, native, or external scan engines and can optionally use LLM semantic analysis. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[cyzlmh](https://clawhub.ai/user/cyzlmh) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and security reviewers use this skill to inspect local skill packages, archives, or release bundles before installation and review engine findings, risk level, and installation guidance. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The bundled or downloaded scanner binary must be trusted before execution. <br>\nMitigation: Verify the published SHA-256 checksum before running the binary, or build from source when stronger supply-chain assurance is required. <br>\nRisk: Optional LLM review can send bounded target-package text to a user-configured endpoint, and basic redaction may not remove all sensitive text. <br>\nMitigation: Enable LLM review only with trusted endpoints and review the target package for sensitive data before opting in. <br>\nRisk: Auto or external engine modes may execute a locally resolved external scanner with the current user's permissions. <br>\nMitigation: Use the native engine for isolated local scanning, or separately trust and configure any external scanner before enabling it. <br>\nRisk: Optional report upload sends structured scan reports to the configured upload URL. <br>\nMitigation: Leave upload disabled unless the destination is approved and the instance identifier and report contents are appropriate to share. <br>\n\n\n## Reference(s): <br>\n- [CMIC Skill Scanner (Linux x64) on ClawHub](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-amd64) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [Text, Markdown, Shell commands, Configuration, Guidance] <br>\n**Output Format:** [Markdown and command-line scanner reports] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Reports may include engine status, findings, risk levels, and optional local output files when an output directory is configured.] <br>\n\n## Skill Version(s): <br>\n0.11.0 (source: server release metadata and build-info.json) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nFile v0.11.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.11.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1784018453,\n  \"checksum\": \"d29272d8ac33afc18df3ecda2461a1568192ca61b3aeb0044dba3ab687c00d08\"\n}\n\nFile v0.11.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.9.0: 6 files, 4684 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), skill-card.md (2358b), SKILL.md (3271b), _meta.json (149b)\n\nFile v0.9.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool operates **locally** and requires user trust in the binary you run. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.9.0` |\n| Platform | `Linux x64` |\n| SHA-256 | `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- `--upload-url` 和 `--engine external` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**What the tool does NOT do by default:**\n- Does NOT upload data anywhere\n- Does NOT connect to the network\n- Does NOT access credentials, SSH configs, or environment variables\n- Does NOT execute external tools unless you explicitly configure `--engine external`\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## 外部引擎集成 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--engine external`.\n\nDelegates pattern-matching to a user-configured local tool. This runs **locally** — no remote calls are made.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary | To run the scanner engine |\n| Network (optional) | **Only if `--upload-url` is explicitly configured** |\n\nFile v0.9.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.9.0\",\n  \"publishedAt\": 1779962664019\n}\n\nFile v0.9.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.9.0:skill-card.md\n\n## Description: <br>\nAudits local skill packages or archives with a bundled Rust scanner engine and can optionally bridge to an external scanner. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[cyzlmh](https://clawhub.ai/user/cyzlmh) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and security reviewers use this skill to inspect local skill bundles before installation and review scanner findings, summaries, and installation risk signals. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: Uploaded scan reports may disclose sensitive project review details. <br>\nMitigation: Use local scan mode by default and configure --upload-url only for trusted internal HTTPS endpoints after reviewing report contents. <br>\nRisk: The release includes a bundled executable scanner that requires trust in the publisher or binary provenance. <br>\nMitigation: Verify the documented SHA-256 checksum before execution, or build the scanner from source after reviewing it. <br>\nRisk: External scanner bridging can execute user-configured local tooling. <br>\nMitigation: Enable the external engine only when the configured scanner is trusted and its behavior is understood. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-amd64) <br>\n- [Publisher profile](https://clawhub.ai/user/cyzlmh) <br>\n- [Build source referenced by artifact](https://gitee.com/random_player/cmic-skill-scanner.git) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [text, markdown, shell commands, guidance] <br>\n**Output Format:** [Markdown and command examples describing scan findings, risk level, and installation guidance.] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [May write local scan reports when an output directory is provided; report upload is optional and disabled unless explicitly configured.] <br>\n\n## Skill Version(s): <br>\n0.9.0 (source: server release metadata and bundled build metadata) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nFile v0.9.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.9.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1779962644,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.9.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.8.0: 5 files, 3443 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (3271b), _meta.json (149b)\n\nFile v0.8.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool operates **locally** and requires user trust in the binary you run. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.8.0` |\n| Platform | `Linux x64` |\n| SHA-256 | `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- `--upload-url` 和 `--engine external` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**What the tool does NOT do by default:**\n- Does NOT upload data anywhere\n- Does NOT connect to the network\n- Does NOT access credentials, SSH configs, or environment variables\n- Does NOT execute external tools unless you explicitly configure `--engine external`\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## 外部引擎集成 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--engine external`.\n\nDelegates pattern-matching to a user-configured local tool. This runs **locally** — no remote calls are made.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary | To run the scanner engine |\n| Network (optional) | **Only if `--upload-url` is explicitly configured** |\n\nFile v0.8.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.8.0\",\n  \"publishedAt\": 1776792730938\n}\n\nFile v0.8.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.8.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.8.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776792695,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.8.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.4: 5 files, 2688 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (2217b), _meta.json (149b)\n\nFile v0.6.4:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.4\ndescription: Security scanner for AI agent skills. Analyzes skill source code to detect malware patterns, credential theft attempts, and suspicious code. Open source (MIT-0).\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/random_player/cmic-skill-scanner\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nSecurity scanner that analyzes skill source code before installation.\n\n**Source code**: https://gitee.com/random_player/cmic-skill-scanner\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.6.4` |\n| Platform | `Linux x64` |\n| SHA-256 | `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\n## Source Code & Verification\n\n- **Repository**: https://gitee.com/random_player/cmic-skill-scanner\n- **Checksums**: https://gitee.com/random_player/cmic-skill-scanner/raw/main/releases/v0.6.4/SHA256SUMS\n- **Releases**: https://gitee.com/random_player/cmic-skill-scanner/releases/v0.6.4\n\n\n## What This Scanner Does\n\nThis tool reads skill source files you specify and reports findings. It analyzes the skill's code, not your system.\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Detects in Skills\n\n| Category | Suspicious Pattern |\n|----------|-------------------|\n| Network calls | curl/wget to unknown URLs, calls to IP addresses |\n| Obfuscation | base64 decode, eval/exec with external input, minified code |\n| Credential access | skill attempts to read ~/.ssh, ~/.aws, ~/.config |\n| Permission requests | skill requests elevated/sudo, modifies system files |\n| Data exfiltration | skill uploads to external servers, sends credentials |\n\n**Note**: These are patterns the scanner detects IN the skill being analyzed, not actions the scanner performs.\n\n## License\n\nMIT-0 (Public Domain). Full source: https://gitee.com/random_player/cmic-skill-scanner\n\nFile v0.6.4:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.6.4\",\n  \"publishedAt\": 1776765942466\n}\n\nFile v0.6.4:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.4:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.4\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776765912,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.6.4:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.3: 5 files, 2674 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (2137b), _meta.json (149b)\n\nFile v0.6.3:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.3\ndescription: Security scanner for AI agent skills. Detects malware patterns, credential theft, and suspicious code. Open source (MIT-0), source code on Gitee.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/random_player/cmic-skill-scanner\n  permissions:\n    - local-file-read\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nOpen-source security scanner for AI agent skills.\n\n**Source code**: https://gitee.com/random_player/cmic-skill-scanner\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.6.3` |\n| Platform | `Linux x64` |\n| SHA-256 | `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\n## Source Code & Verification\n\n- **Repository**: https://gitee.com/random_player/cmic-skill-scanner\n- **Checksums**: https://gitee.com/random_player/cmic-skill-scanner/raw/main/releases/v0.6.3/SHA256SUMS\n- **Releases**: https://gitee.com/random_player/cmic-skill-scanner/releases/v0.6.3\n\n\n## Permissions Required\n\nWhen run, this scanner reads local files to analyze them:\n- Skill packages you point it at (your specified paths)\n- Source code files within those skill directories\n\n**It does NOT**: read arbitrary system files, access credentials, or make network calls.\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Detects\n\n| Category | Examples |\n|----------|----------|\n| Malware patterns | curl/wget to unknown URLs, obfuscated code, base64 decode |\n| Credential theft | reads ~/.ssh, ~/.aws, ~/.config, requests tokens |\n| Suspicious permissions | elevated access, system file modifications |\n| Data exfiltration | uploads to external servers, embeds external URLs |\n\n## License\n\nMIT-0 (Public Domain). Full source: https://gitee.com/random_player/cmic-skill-scanner\n\nFile v0.6.3:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.6.3\",\n  \"publishedAt\": 1776764238990\n}\n\nFile v0.6.3:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.3:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.3\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776764207,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.6.3:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.2: 5 files, 2396 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1442b), _meta.json (149b)\n\nFile v0.6.2:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.2\ndescription: Security scanner for AI agent skills. Detects malware patterns, credential theft, and suspicious code before installation. Open source, MIT-0 licensed.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/cyzlmh/cmic-skill-scanner\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nOpen-source security scanner for AI agent skills. **Source code**: https://gitee.com/cyzlmh/cmic-skill-scanner\n\n## Binary Included\n\nThis package contains the pre-built binary:\n\n- Location: `assets/bin/skillscan`\n- Version: `v0.6.2`\n- Platform: `Linux x64`\n- SHA-256: `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8`\n\n**Verify locally**: Run `sha256sum assets/bin/skillscan` and compare with above.\n\n## Other Platforms\n\nPre-built binaries for other platforms:\nhttps://gitee.com/cyzlmh/cmic-skill-scanner/releases\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Checks\n\n- Malware patterns (curl/wget to unknown URLs, obfuscated code)\n- Credential theft (reads ~/.ssh, ~/.aws, requests tokens)\n- Suspicious permissions (elevated access, system file modifications)\n- Data exfiltration risks\n\n## License\n\nMIT-0 (Public Domain). Source: https://gitee.com/cyzlmh/cmic-skill-scanner\n\nFile v0.6.2:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.6.2\",\n  \"publishedAt\": 1776760968712\n}\n\nFile v0.6.2:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.2:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.2\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776760937,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.6.2:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.1: 5 files, 2440 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1519b), _meta.json (149b)\n\nFile v0.6.1:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.1\ndescription: Security audit tool for AI agent skills. Self-contained package with binary included - no external download needed. Scans for malware, credential theft, and suspicious patterns before installation.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  tags:\n    - security\n    - scanner\n    - audit\n    - skill-security\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\n**DEFENSIVE SECURITY TOOL** - Audit skills before installation.\n\n## Built-in Binary\n\n- Path: `assets/bin/skillscan`\n- Version: `v0.6.1`\n- Platform: `linux-amd64`\n- SHA-256: `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8`\n\n\n## Pure Version (external download)\n\nFor other platforms or to download separately:\nhttps://clawhub.ai/cyzlmh/cmic-skill-scanner\n\n## Usage\n\n```bash\n# Review a skill package or directory\nskillscan review /path/to/skill --format markdown\n\n# Scan multiple skills and save results\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n\n# Use external engine (requires skill-scanner CLI installed)\nskillscan review /path/to/skill --engine external --format markdown\n```\n\n## Output\n\n- Input type detection\n- Engine execution status\n- Security findings with risk levels\n- Recommendations\n\n## Enterprise Integration\n\n```bash\nskillscan review /path/to/skills   --output-dir /tmp/skillscan-out   --upload-url https://scanner.example.com/api/report   --instance-id prod-a1\n```\n\n## License\n\nMIT-0 (Public Domain)\n\nFile v0.6.1:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.6.1\",\n  \"publishedAt\": 1776759628669\n}\n\nFile v0.6.1:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.1:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776759596,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.6.1:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.0: 5 files, 2670 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1714b), _meta.json (149b)\n\nFile v0.6.0:SKILL.md\n\n---\nname: cmic-skill-scanner\ndescription: Security audit tool for AI agent skills. Self-contained package with binary included - no external download needed. Scans for malware, credential theft, and suspicious patterns before installation.\nlicense: MIT\nauthor: CMIC Skill Scanner\n---\n\n# CMIC Skill Scanner\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## 内置二进制\n\n- 路径: `assets/bin/skillscan`\n- 版本: `v0.6.0`\n- 平台: `linux/amd64`\n- SHA-256: `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8`\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- 如果要桥接外部 scanner，再额外提供 `--engine external` 或 `--engine auto`\n\n## 工作流程\n\n1. 调用 wrapper：\n\n```bash\n./assets/bin/skillscan review /path/to/target --format markdown\n./assets/bin/skillscan review /path/to/target --engine external --format markdown\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：\n   - 输入类型\n   - 完整度\n   - engine 执行状态\n   - findings\n\n3. 如果输入只是 HTML 页面或其他非 scanner-ready 形式，先获取完整本地包再重试。\n\n## 企业集成\n\n如果要扫描一个目录下的全部 skill，并把结果落盘：\n\n```bash\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n如果还要上报：\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\n上报内容包含每个 skill 的完整 `review` 详情，而不是仅上传本地结果文件路径。\n\nFile v0.6.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.6.0\",\n  \"publishedAt\": 1776758040108\n}\n\nFile v0.6.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776758011,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.6.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.5.0: 5 files, 2592 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1612b), _meta.json (149b)\n\nFile v0.5.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## 内置二进制\n\n- 路径: `assets/bin/skillscan`\n- 版本: `v0.5.0`\n- 平台: `linux/amd64`\n- SHA-256: `864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8`\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- 如果要桥接外部 scanner，再额外提供 `--engine external` 或 `--engine auto`\n\n## 工作流程\n\n1. 调用 wrapper：\n\n```bash\n./assets/bin/skillscan review /path/to/target --format markdown\n./assets/bin/skillscan review /path/to/target --engine external --format markdown\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：\n   - 输入类型\n   - 完整度\n   - engine 执行状态\n   - findings\n\n3. 如果输入只是 HTML 页面或其他非 scanner-ready 形式，先获取完整本地包再重试。\n\n## 企业集成\n\n如果要扫描一个目录下的全部 skill，并把结果落盘：\n\n```bash\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n如果还要上报：\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\n上报内容包含每个 skill 的完整 `review` 详情，而不是仅上传本地结果文件路径。\n\nFile v0.5.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.5.0\",\n  \"publishedAt\": 1776755634503\n}\n\nFile v0.5.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.5.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.5.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776755092,\n  \"checksum\": \"864f9a0189268139878c06bce7a127687f9e491a070d7c7345d22932c899bcd8\"\n}\n\nFile v0.5.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。","readmeExcerpt":"Skill: CMIC Skill Scanner (Linux x64) Owner: cyzlmh Summary: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 Tags: latest:0.11.1 Version history: v0.11.1 | 2026-07-27T06:43:04.167Z | auto - Updated included binary to version v0.11.1 (Linux x64) with new SHA-256 hash. - Refreshed SKILL.md to reflect the new binary version and checksum. - Removed obsolete skill-card.md file. - Minor documentation and buil","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"sha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above"},{"language":"bash","snippet":"git clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release"},{"language":"bash","snippet":"skillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out"},{"language":"bash","snippet":"skillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model"},{"language":"bash","snippet":"shasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256"},{"language":"bash","snippet":"./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.1` |\n| Platform | `Linux x64` |\n| SHA-256 | `bb3847f3afca734ef0cf6c061f553602b3df5dad23f726215d25812b74d01bf0` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional and "},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-amd64\",\n  \"version\": \"0.11.1\",\n  \"publishedAt\": 1785134584167\n}"},{"path":"INSTALL.md","content":"# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Linux glibc Compatibility\n\nThere are two x86_64 Linux builds. Pick the right one **before** downloading:\n\n| Package | Target systems | Requirement |\n|---------|---------------|-------------|\n| `linux-amd64` | Ubuntu 20.04+, Debian 11+, RHEL 9+, Fedora 31+ | glibc >= 2.30 |\n| `bclinux21-amd64` | BCLinux 21/8.2, CentOS 7/8, RHEL 7/8, Amazon Linux 2 | none (static musl) |\n\nCheck your glibc version first:\n\n```bash\nldd --version | head -1          # glibc < 2.30  -> use bclinux21-amd64\ncat /etc/os-release | grep -i \"bclinux\\|bigcloud\"   # matches -> use bclinux21-amd64\n```\n\nIf you run `linux-amd64` and see `version 'GLIBC_2.30' not found` (or similar),\nyour glibc is too old — switch to the `bclinux21-amd64` package, which is\nstatically linked with musl and does not depend on the system glibc.\n\n## Common Commands\n\n```bash\n./assets/bin/skillsca"},{"path":"skill-card.md","content":"## Description:\n\nAudits local skill packages or archives with auto, native, or external scanner engines and can optionally enable LLM semantic review.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[cyzlmh](https://clawhub.ai/user/cyzlmh)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and engineers use this skill to run a local security review before installing a skill package, archive, or release bundle. It helps summarize scanner engine status, findings, risk level, and installation guidance.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The release evidence says the packaged binary and checksum are missing, so the claimed bundled binary should not be trusted without verification.\n\nMitigation: Confirm the package contains the expected binary and checksum before running it; verify the SHA-256 value or build from source.\n\nRisk: Default auto mode may run a locally resolved external scanner with the current user's permissions.\n\nMitigation: Use --engine native unless the resolved external scanner and its configuration are trusted.\n\nRisk: Optional LLM review or report upload can send scan data to configured endpoints.\n\nMitigation: Enable --use-llm or --upload-url only with endpoints you control and whose data-handling behavior is understood.\n\n## Reference(s):\n\n- [CMIC Skill Scanner ClawHub Page](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-amd64)\n- [CMIC Skill Scanner source repository referenced by package documentation](https://gitee.com/random_player/cmic-skill-scanner.git)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Shell commands, Configuration, Guidance]\n\n**Output Format:** [Markdown guidance with command examples and optional JSON or Markdown scan reports]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [May write scan reports to a user-specified output directory.]\n\n## Skill Version(s):\n\n0.11.1 (source: server release metadata and assets/build/build-info.json)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."},{"path":"assets/build/build-info.json","content":"{\n  \"version\": \"v0.11.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"amd64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1785134501,\n  \"checksum\": \"bb3847f3afca734ef0cf6c061f553602b3df5dad23f726215d25812b74d01bf0\"\n}"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1773,"uniquenessScore":40,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-10T09:05:35.070Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-10T11:51:24.416Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}