{"id":"1e045f08-1a29-425f-9f13-7ea1300c3496","entityType":"agent","slug":"clawhub-cyzlmh-cmic-skill-scanner-linux-arm64","name":"CMIC Skill Scanner (Linux ARM64)","canonicalUrl":"https://www.xpersona.co/agent/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64","canonicalPath":"/agent/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64","generatedAt":"2026-10-10T13:32:27.623Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":null},"description":"使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 1.5K downloads reported by the source. Last updated 10/10/2026.","installCommand":"clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-arm64","sourceUrl":"https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-arm64","homepage":"https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-arm64","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-arm64","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-arm64","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":64,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"CMIC Skill Scanner (Linux ARM64) technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":null},"stars":null,"forks":null,"downloads":1505,"packageName":null,"latestVersion":"0.11.1","tractionLabel":"1.5K downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":null},"lastUpdatedAt":"2026-10-10T10:09:30.474Z","lastCrawledAt":"2026-10-10T10:09:30.474Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-11T10:09:30.474Z","lastVerifiedAt":null,"highlights":[{"version":"0.11.1","createdAt":"2026-07-27T06:43:12.315Z","changelog":"- Updated bundled binary to v0.11.1 for Linux ARM64 with new SHA-256 checksum. - SKILL.md reflects the new binary version and checksum details. - Removed the obsolete skill-card.md file. - Minor documentation and metadata updates in supporting files.","fileCount":6,"zipByteSize":6616},{"version":"0.11.0","createdAt":"2026-07-14T08:42:40.464Z","changelog":"- Added optional LLM-based semantic review; enable with `--use-llm` for native, external, or auto engine modes - Updated default mode to `auto`: tries a local external scanner first, falls back to built-in native engine if unavailable - Expanded network and trust model documentation—clarifies what data is sent, when network calls occur, and redaction limits for LLM review - Updated bundled binary to version v0.11.0 with new checksum - Removed obsolete `skill-card.md` file","fileCount":6,"zipByteSize":6170},{"version":"0.9.0","createdAt":"2026-05-28T10:04:33.703Z","changelog":"- Updated bundled binary version to v0.9.0 for Linux ARM64. - SKILL.md reflects the new binary version; checksum and other instructions unchanged. - No changes to user-facing functionality or workflow.","fileCount":6,"zipByteSize":4640},{"version":"0.8.0","createdAt":"2026-04-21T17:32:16.085Z","changelog":"v0.8.0 introduces breaking changes and major documentation/usage updates. - Renamed the skill to \"skillscan-wrapper\" with a new purpose and description. - Completely overhauled documentation: clearer security notes, detailed trust model, Chinese localization. - Updated binary info: Version bump to 0.8.0 (Linux ARM64). - Added explanations for optional features (`--upload-url`, `--engine external`), which remain disabled by default. - Outlined explicit permissions and clarified user responsibilities for verification and security.","fileCount":5,"zipByteSize":3441},{"version":"0.6.4","createdAt":"2026-04-21T10:05:50.530Z","changelog":"- Updated to version 0.6.4. - Improved documentation with clearer descriptions of what the scanner checks and how it operates. - Revised detection categories for more precise explanation of what is flagged in skills. - Updated release and checksum links to match the new version. - Streamlined permissions and removed redundant metadata.","fileCount":5,"zipByteSize":2684},{"version":"0.6.3","createdAt":"2026-04-21T09:37:23.533Z","changelog":"- Updated to version 0.6.3. - Changed author repository URL from cyzlmh to random_player. - Added explicit permissions section noting local file read requirements. - Improved documentation with clearer verification and usage instructions. - Provided checksums and direct links for verifying the release. - Expanded feature descriptions for increased transparency.","fileCount":5,"zipByteSize":2668},{"version":"0.6.2","createdAt":"2026-04-21T08:42:54.116Z","changelog":"- Updated to version 0.6.2 with an improved SKILL.md description and metadata. - Added repository link and open source details; emphasized MIT-0 license. - Clarified included binary location, version, and verification instructions. - Listed key security checks for better transparency. - Updated links for releases and documentation.","fileCount":5,"zipByteSize":2391},{"version":"0.6.1","createdAt":"2026-04-21T08:20:34.850Z","changelog":"- Updated built-in scanner binary to version 0.6.1 in documentation. - Revised SKILL.md for improved clarity, adding version, license details (MIT-0), author metadata, tags, and usage triggers. - Enhanced English usage instructions and output details. - Added instructions for downloading for other platforms. - Minor metadata and formatting improvements for enterprise and public use.","fileCount":5,"zipByteSize":2436}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-arm64","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s171nn815hk3s0ht69bn9d96hn858ye2:cmic-skill-scanner-linux-arm64` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-arm64 before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-10T13:32:27.622Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-cyzlmh-cmic-skill-scanner-linux-arm64/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":null},"readme":"Skill: CMIC Skill Scanner (Linux ARM64)\n\nOwner: cyzlmh\n\nSummary: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\n\nTags: latest:0.11.1\n\nVersion history:\n\nv0.11.1 | 2026-07-27T06:43:12.315Z | auto\n\n- Updated bundled binary to v0.11.1 for Linux ARM64 with new SHA-256 checksum.\n- SKILL.md reflects the new binary version and checksum details.\n- Removed the obsolete skill-card.md file.\n- Minor documentation and metadata updates in supporting files.\n\nv0.11.0 | 2026-07-14T08:42:40.464Z | auto\n\n- Added optional LLM-based semantic review; enable with `--use-llm` for native, external, or auto engine modes\n- Updated default mode to `auto`: tries a local external scanner first, falls back to built-in native engine if unavailable\n- Expanded network and trust model documentation—clarifies what data is sent, when network calls occur, and redaction limits for LLM review\n- Updated bundled binary to version v0.11.0 with new checksum\n- Removed obsolete `skill-card.md` file\n\nv0.9.0 | 2026-05-28T10:04:33.703Z | auto\n\n- Updated bundled binary version to v0.9.0 for Linux ARM64.\n- SKILL.md reflects the new binary version; checksum and other instructions unchanged.\n- No changes to user-facing functionality or workflow.\n\nv0.8.0 | 2026-04-21T17:32:16.085Z | auto\n\nv0.8.0 introduces breaking changes and major documentation/usage updates.\n\n- Renamed the skill to \"skillscan-wrapper\" with a new purpose and description.\n- Completely overhauled documentation: clearer security notes, detailed trust model, Chinese localization.\n- Updated binary info: Version bump to 0.8.0 (Linux ARM64).\n- Added explanations for optional features (`--upload-url`, `--engine external`), which remain disabled by default.\n- Outlined explicit permissions and clarified user responsibilities for verification and security.\n\nv0.6.4 | 2026-04-21T10:05:50.530Z | auto\n\n- Updated to version 0.6.4.\n- Improved documentation with clearer descriptions of what the scanner checks and how it operates.\n- Revised detection categories for more precise explanation of what is flagged in skills.\n- Updated release and checksum links to match the new version.\n- Streamlined permissions and removed redundant metadata.\n\nv0.6.3 | 2026-04-21T09:37:23.533Z | auto\n\n- Updated to version 0.6.3.\n- Changed author repository URL from cyzlmh to random_player.\n- Added explicit permissions section noting local file read requirements.\n- Improved documentation with clearer verification and usage instructions.\n- Provided checksums and direct links for verifying the release.\n- Expanded feature descriptions for increased transparency.\n\nv0.6.2 | 2026-04-21T08:42:54.116Z | auto\n\n- Updated to version 0.6.2 with an improved SKILL.md description and metadata.\n- Added repository link and open source details; emphasized MIT-0 license.\n- Clarified included binary location, version, and verification instructions.\n- Listed key security checks for better transparency.\n- Updated links for releases and documentation.\n\nv0.6.1 | 2026-04-21T08:20:34.850Z | auto\n\n- Updated built-in scanner binary to version 0.6.1 in documentation.\n- Revised SKILL.md for improved clarity, adding version, license details (MIT-0), author metadata, tags, and usage triggers.\n- Enhanced English usage instructions and output details.\n- Added instructions for downloading for other platforms.\n- Minor metadata and formatting improvements for enterprise and public use.\n\nv0.6.0 | 2026-04-21T07:54:05.723Z | auto\n\n- Updated SKILL.md with improved English description and rebranded package name to \"cmic-skill-scanner\".\n- Maintained all command usage details and integration examples.\n- Updated embedded binary version to v0.6.0 in documentation.\n- No changes to workflow or interface.\n\nv0.5.0 | 2026-04-21T07:14:01.313Z | auto\n\ncmic-skill-scanner-linux-arm64 v0.5.0\n\n- Updated documentation in SKILL.md with a new concise usage guide in Chinese and streamlined enterprise integration instructions.\n- Clarified internal binary version, platform, and checksum details.\n- INSTALL.md and build metadata updated for v0.5.0.\n- No change to core binary or scanning logic in this release.\n\nv0.2.0 | 2026-04-21T05:13:32.634Z | auto\n\n- Added detailed documentation describing the security audit tool, its permissions, usage, and verification steps.\n- Clarified that it is a defensive security tool for skill package scanning prior to installation.\n- Outlined supported triggers, permissions, and explicit user controls for network and file access.\n- Provided checksum verification instructions and source code transparency details.\n- Listed major detection capabilities and platform availability for Linux ARM64.\n\nArchive index:\n\nArchive v0.11.1: 6 files, 6616 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (219b), INSTALL.md (3205b), skill-card.md (2285b), SKILL.md (5604b), _meta.json (150b)\n\nFile v0.11.1:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.1` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `27f301c8f1a2ff32f3ee541b756658f1375c944bc3bf50df7778fc638a814220` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit `--use-llm` and works with `native`, `external`, and `auto`.\n\n```bash\nskillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model\n```\n\nWith `native`, the endpoint receives static-finding summaries and up to 24 text files from the target package (up to 8 KiB each and 64 KiB total). Lines named `api_key`, `token`, `password`, `secret`, or `authorization` are redacted at a basic level. This is not a guarantee that all sensitive text is removed: use only a trusted endpoint and confirm the data-handling policy.\n\nWith a Cisco-compatible `external` engine, CMIC adds `--use-llm` and passes endpoint, model, and optional key to the child process through `SKILL_SCANNER_LLM_*` variables; the external scanner controls its own packet, redaction, and failure behavior. `auto` tries that external LLM first and falls back to native if the external process fails. API keys are never written to the scan command or report.\n\nIf the native LLM request fails, the native static result is still returned and `engine.fallback_reason` records the reason.\n\n## 外部引擎集成\n\nDefault `auto` mode tries a locally resolved external scanner first and falls back to native when it is unavailable or fails. Use `--engine external` to require the external result, or `--engine native` to run only the built-in engine.\n\nCMIC passes the target path to a user-configured local tool. The tool runs with the current user's process permissions; trust the external tool and its configuration separately. CMIC only configures the external LLM endpoint when `--use-llm` is explicitly set; the tool may otherwise bootstrap dependencies or use its own network configuration.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary / external tool | To run the selected scanner engine; `auto` may invoke a locally resolved external scanner |\n| Network (optional) | `--upload-url` sends a JSON report; native `--use-llm` sends a bounded text packet; external `--use-llm` follows the external tool's data policy |\n\nFile v0.11.1:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.11.1\",\n  \"publishedAt\": 1785134592315\n}\n\nFile v0.11.1:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Linux glibc Compatibility\n\nThere are two x86_64 Linux builds. Pick the right one **before** downloading:\n\n| Package | Target systems | Requirement |\n|---------|---------------|-------------|\n| `linux-amd64` | Ubuntu 20.04+, Debian 11+, RHEL 9+, Fedora 31+ | glibc >= 2.30 |\n| `bclinux21-amd64` | BCLinux 21/8.2, CentOS 7/8, RHEL 7/8, Amazon Linux 2 | none (static musl) |\n\nCheck your glibc version first:\n\n```bash\nldd --version | head -1          # glibc < 2.30  -> use bclinux21-amd64\ncat /etc/os-release | grep -i \"bclinux\\|bigcloud\"   # matches -> use bclinux21-amd64\n```\n\nIf you run `linux-amd64` and see `version 'GLIBC_2.30' not found` (or similar),\nyour glibc is too old — switch to the `bclinux21-amd64` package, which is\nstatically linked with musl and does not depend on the system glibc.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark --engine native\n./assets/bin/skillscan package-skill\n```\n\nFile v0.11.1:skill-card.md\n\n## Description:\n\nAudits local skill packages or archives with auto, native, or external scanning engines, with optional LLM semantic review.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[cyzlmh](https://clawhub.ai/user/cyzlmh)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and security reviewers use this skill before installing local skill packages, archives, or release bundles to generate scan findings, risk levels, and a short installation conclusion.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Default auto mode may run a locally resolved external scanner with the current user's permissions.\n\nMitigation: Use --engine native for routine scans, review any external scanner and its configuration before use, and avoid running the tool as an elevated user.\n\nRisk: The install path depends on bundled or downloaded executable artifacts that require separate trust.\n\nMitigation: Verify the binary checksum against an independent trusted source before execution, or build from reviewed source when stronger assurance is needed.\n\nRisk: Explicitly enabled upload or LLM review can send findings or bounded target text to configured endpoints.\n\nMitigation: Enable --upload-url or --use-llm only with approved endpoints and confirm endpoint data-handling policy before scanning sensitive targets.\n\n## Reference(s):\n\n- [ClawHub skill page](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-arm64)\n- [Installation guide](INSTALL.md)\n- [Build metadata](assets/build/build-info.json)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Files, Shell commands, Guidance]\n\n**Output Format:** [Markdown reports and terminal command guidance, with optional local report files.]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Optional upload and LLM review features require explicit endpoint configuration.]\n\n## Skill Version(s):\n\n0.11.1 (source: server release metadata; artifact build-info.json reports v0.11.1)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v0.11.1:assets/build/build-info.json\n\n{\n  \"version\": \"v0.11.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1785134528,\n  \"checksum\": \"27f301c8f1a2ff32f3ee541b756658f1375c944bc3bf50df7778fc638a814220\"\n}\n\nFile v0.11.1:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.11.0: 6 files, 6170 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (219b), INSTALL.md (2400b), skill-card.md (2349b), SKILL.md (5604b), _meta.json (150b)\n\nFile v0.11.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.0` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `8a4b9c55bb35c84f09f3699a46ceb96234ef409bf495e616cd4d2a97b412a838` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit `--use-llm` and works with `native`, `external`, and `auto`.\n\n```bash\nskillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model\n```\n\nWith `native`, the endpoint receives static-finding summaries and up to 24 text files from the target package (up to 8 KiB each and 64 KiB total). Lines named `api_key`, `token`, `password`, `secret`, or `authorization` are redacted at a basic level. This is not a guarantee that all sensitive text is removed: use only a trusted endpoint and confirm the data-handling policy.\n\nWith a Cisco-compatible `external` engine, CMIC adds `--use-llm` and passes endpoint, model, and optional key to the child process through `SKILL_SCANNER_LLM_*` variables; the external scanner controls its own packet, redaction, and failure behavior. `auto` tries that external LLM first and falls back to native if the external process fails. API keys are never written to the scan command or report.\n\nIf the native LLM request fails, the native static result is still returned and `engine.fallback_reason` records the reason.\n\n## 外部引擎集成\n\nDefault `auto` mode tries a locally resolved external scanner first and falls back to native when it is unavailable or fails. Use `--engine external` to require the external result, or `--engine native` to run only the built-in engine.\n\nCMIC passes the target path to a user-configured local tool. The tool runs with the current user's process permissions; trust the external tool and its configuration separately. CMIC only configures the external LLM endpoint when `--use-llm` is explicitly set; the tool may otherwise bootstrap dependencies or use its own network configuration.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary / external tool | To run the selected scanner engine; `auto` may invoke a locally resolved external scanner |\n| Network (optional) | `--upload-url` sends a JSON report; native `--use-llm` sends a bounded text packet; external `--use-llm` follows the external tool's data policy |\n\nFile v0.11.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.11.0\",\n  \"publishedAt\": 1784018560464\n}\n\nFile v0.11.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark --engine native\n./assets/bin/skillscan package-skill\n```\n\nFile v0.11.0:skill-card.md\n\n## Description: <br>\nAudits local skill packages or archives with auto, native, or external scanner engines and optional LLM semantic review. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[cyzlmh](https://clawhub.ai/user/cyzlmh) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and engineers use this skill before installing local skills, archives, or release bundles to run a quick security review and receive engine findings, risk levels, and an installation conclusion. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The visible package may not include the binary paths described in the install text. <br>\nMitigation: Verify the delivered files and checksum before running the scanner. <br>\nRisk: Optional LLM review or report upload can send scan data to configured endpoints. <br>\nMitigation: Use only trusted endpoints and avoid scanning directories containing secrets unless that data exposure is acceptable. <br>\nRisk: The default auto engine may execute a locally resolved external scanner with the current user's permissions. <br>\nMitigation: Use --engine native when you want the most contained built-in scanner behavior. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-arm64) <br>\n- [Publisher profile](https://clawhub.ai/user/cyzlmh) <br>\n- [Source repository link from skill documentation](https://gitee.com/random_player/cmic-skill-scanner.git) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [text, markdown, shell commands, guidance] <br>\n**Output Format:** [Markdown guidance with shell command examples and scanner findings.] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Can write local scan reports when an output directory is configured; optional upload and LLM review modes require explicit user configuration.] <br>\n\n## Skill Version(s): <br>\n0.11.0 (source: server release metadata; bundled build metadata reports v0.11.0) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nFile v0.11.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.11.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1784018479,\n  \"checksum\": \"8a4b9c55bb35c84f09f3699a46ceb96234ef409bf495e616cd4d2a97b412a838\"\n}\n\nFile v0.11.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.9.0: 6 files, 4640 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), skill-card.md (2224b), SKILL.md (3273b), _meta.json (149b)\n\nFile v0.9.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool operates **locally** and requires user trust in the binary you run. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.9.0` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- `--upload-url` 和 `--engine external` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**What the tool does NOT do by default:**\n- Does NOT upload data anywhere\n- Does NOT connect to the network\n- Does NOT access credentials, SSH configs, or environment variables\n- Does NOT execute external tools unless you explicitly configure `--engine external`\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## 外部引擎集成 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--engine external`.\n\nDelegates pattern-matching to a user-configured local tool. This runs **locally** — no remote calls are made.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary | To run the scanner engine |\n| Network (optional) | **Only if `--upload-url` is explicitly configured** |\n\nFile v0.9.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.9.0\",\n  \"publishedAt\": 1779962673703\n}\n\nFile v0.9.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.9.0:skill-card.md\n\n## Description: <br>\nAudits local skill packages or archives with a bundled Rust scanner engine and can optionally bridge to an external scanner. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[cyzlmh](https://clawhub.ai/user/cyzlmh) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and security reviewers use this skill before installing local skill packages, archives, or release bundles to inspect scanner findings, review risk level, and make a concise installation decision. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: A bundled or downloaded scanner binary requires trust in the release host and checksum integrity. <br>\nMitigation: Verify the SHA-256 checksum before execution or build the scanner from source when higher assurance is required. <br>\nRisk: Optional report upload can disclose sensitive project or security review details if sent to an untrusted endpoint. <br>\nMitigation: Use local review mode by default and configure --upload-url only for approved HTTPS endpoints. <br>\nRisk: External scanner mode delegates work to user-configured local tooling. <br>\nMitigation: Enable --engine external only for trusted scanner commands whose behavior has been reviewed. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/cyzlmh/cmic-skill-scanner-linux-arm64) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [Analysis, Markdown, Shell commands, Configuration, Guidance] <br>\n**Output Format:** [Markdown reports and command-line review output] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Can write local scan reports when an output directory is configured; optional upload is available only when the user provides an upload URL.] <br>\n\n## Skill Version(s): <br>\n0.9.0 (source: server release metadata; bundled binary build-info.json reports v0.9.0) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nFile v0.9.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.9.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1779962644,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.9.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.8.0: 5 files, 3441 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (3273b), _meta.json (149b)\n\nFile v0.8.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool operates **locally** and requires user trust in the binary you run. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.8.0` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- `--upload-url` 和 `--engine external` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**What the tool does NOT do by default:**\n- Does NOT upload data anywhere\n- Does NOT connect to the network\n- Does NOT access credentials, SSH configs, or environment variables\n- Does NOT execute external tools unless you explicitly configure `--engine external`\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## 外部引擎集成 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--engine external`.\n\nDelegates pattern-matching to a user-configured local tool. This runs **locally** — no remote calls are made.\n\n## Permissions Required\n\n| Scope | Reason |\n|-------|--------|\n| Read files in target path | To analyze skill source code for patterns |\n| Write to `--output-dir` | To save scan reports locally |\n| Execute binary | To run the scanner engine |\n| Network (optional) | **Only if `--upload-url` is explicitly configured** |\n\nFile v0.8.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.8.0\",\n  \"publishedAt\": 1776792736085\n}\n\nFile v0.8.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.8.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.8.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776792698,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.8.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.4: 5 files, 2684 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (2219b), _meta.json (149b)\n\nFile v0.6.4:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.4\ndescription: Security scanner for AI agent skills. Analyzes skill source code to detect malware patterns, credential theft attempts, and suspicious code. Open source (MIT-0).\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/random_player/cmic-skill-scanner\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nSecurity scanner that analyzes skill source code before installation.\n\n**Source code**: https://gitee.com/random_player/cmic-skill-scanner\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.6.4` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\n## Source Code & Verification\n\n- **Repository**: https://gitee.com/random_player/cmic-skill-scanner\n- **Checksums**: https://gitee.com/random_player/cmic-skill-scanner/raw/main/releases/v0.6.4/SHA256SUMS\n- **Releases**: https://gitee.com/random_player/cmic-skill-scanner/releases/v0.6.4\n\n\n## What This Scanner Does\n\nThis tool reads skill source files you specify and reports findings. It analyzes the skill's code, not your system.\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Detects in Skills\n\n| Category | Suspicious Pattern |\n|----------|-------------------|\n| Network calls | curl/wget to unknown URLs, calls to IP addresses |\n| Obfuscation | base64 decode, eval/exec with external input, minified code |\n| Credential access | skill attempts to read ~/.ssh, ~/.aws, ~/.config |\n| Permission requests | skill requests elevated/sudo, modifies system files |\n| Data exfiltration | skill uploads to external servers, sends credentials |\n\n**Note**: These are patterns the scanner detects IN the skill being analyzed, not actions the scanner performs.\n\n## License\n\nMIT-0 (Public Domain). Full source: https://gitee.com/random_player/cmic-skill-scanner\n\nFile v0.6.4:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.6.4\",\n  \"publishedAt\": 1776765950530\n}\n\nFile v0.6.4:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.4:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.4\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776765914,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.6.4:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.3: 5 files, 2668 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (2139b), _meta.json (149b)\n\nFile v0.6.3:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.3\ndescription: Security scanner for AI agent skills. Detects malware patterns, credential theft, and suspicious code. Open source (MIT-0), source code on Gitee.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/random_player/cmic-skill-scanner\n  permissions:\n    - local-file-read\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nOpen-source security scanner for AI agent skills.\n\n**Source code**: https://gitee.com/random_player/cmic-skill-scanner\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.6.3` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\n## Source Code & Verification\n\n- **Repository**: https://gitee.com/random_player/cmic-skill-scanner\n- **Checksums**: https://gitee.com/random_player/cmic-skill-scanner/raw/main/releases/v0.6.3/SHA256SUMS\n- **Releases**: https://gitee.com/random_player/cmic-skill-scanner/releases/v0.6.3\n\n\n## Permissions Required\n\nWhen run, this scanner reads local files to analyze them:\n- Skill packages you point it at (your specified paths)\n- Source code files within those skill directories\n\n**It does NOT**: read arbitrary system files, access credentials, or make network calls.\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Detects\n\n| Category | Examples |\n|----------|----------|\n| Malware patterns | curl/wget to unknown URLs, obfuscated code, base64 decode |\n| Credential theft | reads ~/.ssh, ~/.aws, ~/.config, requests tokens |\n| Suspicious permissions | elevated access, system file modifications |\n| Data exfiltration | uploads to external servers, embeds external URLs |\n\n## License\n\nMIT-0 (Public Domain). Full source: https://gitee.com/random_player/cmic-skill-scanner\n\nFile v0.6.3:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.6.3\",\n  \"publishedAt\": 1776764243533\n}\n\nFile v0.6.3:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.3:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.3\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776764210,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.6.3:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.2: 5 files, 2391 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1444b), _meta.json (149b)\n\nFile v0.6.2:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.2\ndescription: Security scanner for AI agent skills. Detects malware patterns, credential theft, and suspicious code before installation. Open source, MIT-0 licensed.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  repository: https://gitee.com/cyzlmh/cmic-skill-scanner\n  tags:\n    - security\n    - scanner\n    - audit\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\nOpen-source security scanner for AI agent skills. **Source code**: https://gitee.com/cyzlmh/cmic-skill-scanner\n\n## Binary Included\n\nThis package contains the pre-built binary:\n\n- Location: `assets/bin/skillscan`\n- Version: `v0.6.2`\n- Platform: `Linux ARM64`\n- SHA-256: `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7`\n\n**Verify locally**: Run `sha256sum assets/bin/skillscan` and compare with above.\n\n## Other Platforms\n\nPre-built binaries for other platforms:\nhttps://gitee.com/cyzlmh/cmic-skill-scanner/releases\n\n## Usage\n\n```bash\nskillscan review /path/to/skill --format markdown\nskillscan review /path/to/skills --output-dir ./results\n```\n\n## What It Checks\n\n- Malware patterns (curl/wget to unknown URLs, obfuscated code)\n- Credential theft (reads ~/.ssh, ~/.aws, requests tokens)\n- Suspicious permissions (elevated access, system file modifications)\n- Data exfiltration risks\n\n## License\n\nMIT-0 (Public Domain). Source: https://gitee.com/cyzlmh/cmic-skill-scanner\n\nFile v0.6.2:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.6.2\",\n  \"publishedAt\": 1776760974116\n}\n\nFile v0.6.2:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.2:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.2\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776760939,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.6.2:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.1: 5 files, 2436 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1519b), _meta.json (149b)\n\nFile v0.6.1:SKILL.md\n\n---\nname: cmic-skill-scanner\nversion: 0.6.1\ndescription: Security audit tool for AI agent skills. Self-contained package with binary included - no external download needed. Scans for malware, credential theft, and suspicious patterns before installation.\nlicense: MIT-0\nmetadata:\n  author: cyzlmh\n  tags:\n    - security\n    - scanner\n    - audit\n    - skill-security\n  triggers:\n    - \"scan this skill\"\n    - \"audit skill before install\"\n---\n\n# CMIC Skill Scanner\n\n**DEFENSIVE SECURITY TOOL** - Audit skills before installation.\n\n## Built-in Binary\n\n- Path: `assets/bin/skillscan`\n- Version: `v0.6.1`\n- Platform: `linux-arm64`\n- SHA-256: `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7`\n\n\n## Pure Version (external download)\n\nFor other platforms or to download separately:\nhttps://clawhub.ai/cyzlmh/cmic-skill-scanner\n\n## Usage\n\n```bash\n# Review a skill package or directory\nskillscan review /path/to/skill --format markdown\n\n# Scan multiple skills and save results\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n\n# Use external engine (requires skill-scanner CLI installed)\nskillscan review /path/to/skill --engine external --format markdown\n```\n\n## Output\n\n- Input type detection\n- Engine execution status\n- Security findings with risk levels\n- Recommendations\n\n## Enterprise Integration\n\n```bash\nskillscan review /path/to/skills   --output-dir /tmp/skillscan-out   --upload-url https://scanner.example.com/api/report   --instance-id prod-a1\n```\n\n## License\n\nMIT-0 (Public Domain)\n\nFile v0.6.1:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.6.1\",\n  \"publishedAt\": 1776759634850\n}\n\nFile v0.6.1:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.1:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776759599,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.6.1:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.6.0: 5 files, 2664 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1714b), _meta.json (149b)\n\nFile v0.6.0:SKILL.md\n\n---\nname: cmic-skill-scanner\ndescription: Security audit tool for AI agent skills. Self-contained package with binary included - no external download needed. Scans for malware, credential theft, and suspicious patterns before installation.\nlicense: MIT\nauthor: CMIC Skill Scanner\n---\n\n# CMIC Skill Scanner\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## 内置二进制\n\n- 路径: `assets/bin/skillscan`\n- 版本: `v0.6.0`\n- 平台: `linux/arm64`\n- SHA-256: `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7`\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- 如果要桥接外部 scanner，再额外提供 `--engine external` 或 `--engine auto`\n\n## 工作流程\n\n1. 调用 wrapper：\n\n```bash\n./assets/bin/skillscan review /path/to/target --format markdown\n./assets/bin/skillscan review /path/to/target --engine external --format markdown\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：\n   - 输入类型\n   - 完整度\n   - engine 执行状态\n   - findings\n\n3. 如果输入只是 HTML 页面或其他非 scanner-ready 形式，先获取完整本地包再重试。\n\n## 企业集成\n\n如果要扫描一个目录下的全部 skill，并把结果落盘：\n\n```bash\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n如果还要上报：\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\n上报内容包含每个 skill 的完整 `review` 详情，而不是仅上传本地结果文件路径。\n\nFile v0.6.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.6.0\",\n  \"publishedAt\": 1776758045723\n}\n\nFile v0.6.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.6.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.6.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776758014,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.6.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。\n\nArchive v0.5.0: 5 files, 2587 bytes\n\nFiles: agents/openai.yaml (241b), assets/build/build-info.json (218b), INSTALL.md (1222b), SKILL.md (1612b), _meta.json (149b)\n\nFile v0.5.0:SKILL.md\n\n---\nname: skillscan-wrapper\ndescription: 使用内置 Rust 引擎审计待安装的 skill 包或归档，并可选桥接外部 scanner。\nlicense: MIT\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## 内置二进制\n\n- 路径: `assets/bin/skillscan`\n- 版本: `v0.5.0`\n- 平台: `linux/arm64`\n- SHA-256: `ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7`\n\n## 前置条件\n\n- 默认不需要任何外部依赖\n- 如果要桥接外部 scanner，再额外提供 `--engine external` 或 `--engine auto`\n\n## 工作流程\n\n1. 调用 wrapper：\n\n```bash\n./assets/bin/skillscan review /path/to/target --format markdown\n./assets/bin/skillscan review /path/to/target --engine external --format markdown\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：\n   - 输入类型\n   - 完整度\n   - engine 执行状态\n   - findings\n\n3. 如果输入只是 HTML 页面或其他非 scanner-ready 形式，先获取完整本地包再重试。\n\n## 企业集成\n\n如果要扫描一个目录下的全部 skill，并把结果落盘：\n\n```bash\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n如果还要上报：\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\n上报内容包含每个 skill 的完整 `review` 详情，而不是仅上传本地结果文件路径。\n\nFile v0.5.0:_meta.json\n\n{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.5.0\",\n  \"publishedAt\": 1776755641313\n}\n\nFile v0.5.0:INSTALL.md\n\n# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n4. If you want to use an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Common Commands\n\n```bash\n./assets/bin/skillscan inspect /path/to/skill\n./assets/bin/skillscan scan /path/to/skill\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan benchmark\n./assets/bin/skillscan package-skill\n```\n\nFile v0.5.0:assets/build/build-info.json\n\n{\n  \"version\": \"v0.5.0\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1776755095,\n  \"checksum\": \"ee7fd87a3ad72984fcd60ba3adae1020fe7099d24332b7cc30e66034cd745dd7\"\n}\n\nFile v0.5.0:agents/openai.yaml\n\ndisplay_name: Skill Scan\nshort_description: 用内置 Rust 引擎审计待安装的 skill 包，并可选桥接外部 scanner。\ndefault_prompt: 审计这个本地 skill 目标，输出 engine findings、风险等级和简短安装结论。","readmeExcerpt":"Skill: CMIC Skill Scanner (Linux ARM64) Owner: cyzlmh Summary: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。 Tags: latest:0.11.1 Version history: v0.11.1 | 2026-07-27T06:43:12.315Z | auto - Updated bundled binary to v0.11.1 for Linux ARM64 with new SHA-256 checksum. - SKILL.md reflects the new binary version and checksum details. - Removed the obsolete skill-card.md file. - Minor documentation and met","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"sha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above"},{"language":"bash","snippet":"git clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release"},{"language":"bash","snippet":"skillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out"},{"language":"bash","snippet":"skillscan review /path/to/target --engine native --use-llm   --llm-endpoint http://localhost:11434/v1   --llm-model your-model"},{"language":"bash","snippet":"shasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256"},{"language":"bash","snippet":"./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: skillscan-wrapper\ndescription: 使用 auto、native 或 external 引擎审计待安装的 skill 包或归档，并可选启用 LLM 语义分析。\nlicense: MIT-0\nauthor: CMIC Skill Scanner\n---\n\n# Skill Scan Wrapper\n\n当你要在安装一个本地 skill、归档或 release bundle 前做一次快速安全检查时，使用这个 skill。\n\n## ⚠️ Security Notice\n\nThis tool scans locally by default and requires user trust in the binary you run. Native LLM review sends a bounded text packet to a user-configured endpoint; external LLM review follows the external scanner's data policy. **Always verify the checksum after downloading**. For maximum security, build from source (recommended).\n\n## Binary Included\n\n| Property | Value |\n|----------|-------|\n| Location | `assets/bin/skillscan` |\n| Version | `v0.11.1` |\n| Platform | `Linux ARM64` |\n| SHA-256 | `27f301c8f1a2ff32f3ee541b756658f1375c944bc3bf50df7778fc638a814220` |\n\n**Verify locally before running:**\n```bash\nsha256sum assets/bin/skillscan\n# Compare output with the SHA-256 value above\n```\n\nThis bundled package includes a pre-compiled binary. You can still build from source if you prefer:\n\n```bash\ngit clone https://gitee.com/random_player/cmic-skill-scanner.git\ncd cmic-skill-scanner && cargo build --release\n```\n\n\n## 前置条件\n\n- 默认 `auto` 模式会优先尝试本地可解析的 external scanner；没有可用 scanner 时回退到内置 native 引擎\n- 不安装 external scanner 也可以使用：单二进制会回退到 native\n- `--upload-url` 和 `--use-llm` 功能**默认禁用**，仅在用户显式配置时启用\n\n## 信任模型\n\nThis is an **open-source (MIT-0) package**. The binary (bundled or downloaded) is a **convenience only** — it does not grant any additional trust.\n\n**Your options:**\n\n| Approach | Trust Requirement | Verification |\n|----------|------------------|--------------|\n| Build from source | None (you control everything) | Manual code review |\n| Bundled/downloaded binary | You trust the release host | SHA-256 checksum |\n\n**Default behavior and trust boundaries:**\n- CMIC does NOT upload reports unless you configure `--upload-url`\n- CMIC does NOT configure an LLM endpoint unless you set `--use-llm`\n- `auto` may execute a locally resolved external scanner; use `--engine native` to prevent that\n- Does NOT access credentials or SSH configs as scan targets unless they are under the path you explicitly scan\n\n## 工作流程\n\n1. 调用 skillscan：\n\n```bash\nskillscan review /path/to/target --format markdown\nskillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\n2. 阅读输出中的：输入类型、完整度、engine 执行状态、findings\n\n## 网络上传功能 (默认禁用)\n\n**⚠️ This feature is completely optional and disabled by default.** It requires explicit user configuration via `--upload-url`.\n\nThis applies to report upload only. LLM review is a separate, explicit network feature; a resolved external scanner has its own dependency and network behavior.\n\n**What gets sent** (only when you configure `--upload-url`):\n- A structured JSON report containing detection findings\n- An instance identifier you supply via `--instance-id`\n- **No skill source code, credentials, or system configuration is ever transmitted**\n\n## Optional LLM Review\n\n**⚠️ This feature is completely optional an"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn7aj9m1ysjv99m3c7zjkj193d822ydj\",\n  \"slug\": \"cmic-skill-scanner-linux-arm64\",\n  \"version\": \"0.11.1\",\n  \"publishedAt\": 1785134592315\n}"},{"path":"INSTALL.md","content":"# Install\n\n## Package Contents\n\n- Binary: `assets/bin/skillscan`\n- Skill document: `SKILL.md`\n- Build metadata: `assets/build/build-info.json`\n- SHA-256: `assets/build/skillscan.sha256`\n\n## Install Steps\n\n1. Unzip the release package.\n2. Optionally verify the checksum:\n\n```bash\nshasum -a 256 assets/bin/skillscan\ncat assets/build/skillscan.sha256\n```\n\n3. Run the binary directly:\n\n```bash\n./assets/bin/skillscan review /path/to/skill\n./assets/bin/skillscan review /path/to/skills --output-dir /tmp/skillscan-out\n```\n\nThe default engine is `auto`: it prefers a locally resolved external scanner and falls back to the built-in native engine if the external scanner is unavailable or fails. Use `--engine native` to run only the built-in engine.\n\n4. If you want to require an external scanner bridge:\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine external\n```\n\n5. To opt into LLM semantic review, configure a trusted OpenAI-compatible endpoint. `native`, `external`, and `auto` all support `--use-llm`; external scanners must support the Cisco-compatible `--use-llm` contract.\n\n```bash\n./assets/bin/skillscan review /path/to/skill --engine native --use-llm \\\n  --llm-endpoint http://localhost:11434/v1 \\\n  --llm-model your-model\n```\n\nWith `native`, this sends a bounded, basically redacted text packet from the target package to that endpoint. If the LLM is unavailable, the native static result still returns and records `engine.fallback_reason`.\n\nFor `external`, CMIC adds `--use-llm` and passes the endpoint, model, and optional key through\n`SKILL_SCANNER_LLM_BASE_URL`, `SKILL_SCANNER_LLM_MODEL`, and `SKILL_SCANNER_LLM_API_KEY` only to the child\nprocess. The external scanner controls its own data packet and failure handling; `auto` falls back to native if\nthe external process fails.\n\n6. For batch review in enterprise environments:\n\n```bash\n./assets/bin/skillscan review /path/to/skills \\\n  --output-dir /tmp/skillscan-out \\\n  --upload-url https://scanner.example.com/api/report \\\n  --instance-id prod-a1\n```\n\nThe upload payload contains embedded review details for each skill, including the full scan summary and findings.\n\n## Linux glibc Compatibility\n\nThere are two x86_64 Linux builds. Pick the right one **before** downloading:\n\n| Package | Target systems | Requirement |\n|---------|---------------|-------------|\n| `linux-amd64` | Ubuntu 20.04+, Debian 11+, RHEL 9+, Fedora 31+ | glibc >= 2.30 |\n| `bclinux21-amd64` | BCLinux 21/8.2, CentOS 7/8, RHEL 7/8, Amazon Linux 2 | none (static musl) |\n\nCheck your glibc version first:\n\n```bash\nldd --version | head -1          # glibc < 2.30  -> use bclinux21-amd64\ncat /etc/os-release | grep -i \"bclinux\\|bigcloud\"   # matches -> use bclinux21-amd64\n```\n\nIf you run `linux-amd64` and see `version 'GLIBC_2.30' not found` (or similar),\nyour glibc is too old — switch to the `bclinux21-amd64` package, which is\nstatically linked with musl and does not depend on the system glibc.\n\n## Common Commands\n\n```bash\n./assets/bin/skillsca"},{"path":"skill-card.md","content":"## Description:\n\nAudits local skill packages or archives with auto, native, or external scanning engines, with optional LLM semantic review.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[cyzlmh](https://clawhub.ai/user/cyzlmh)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and security reviewers use this skill before installing local skill packages, archives, or release bundles to generate scan findings, risk levels, and a short installation conclusion.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: Default auto mode may run a locally resolved external scanner with the current user's permissions.\n\nMitigation: Use --engine native for routine scans, review any external scanner and its configuration before use, and avoid running the tool as an elevated user.\n\nRisk: The install path depends on bundled or downloaded executable artifacts that require separate trust.\n\nMitigation: Verify the binary checksum against an independent trusted source before execution, or build from reviewed source when stronger assurance is needed.\n\nRisk: Explicitly enabled upload or LLM review can send findings or bounded target text to configured endpoints.\n\nMitigation: Enable --upload-url or --use-llm only with approved endpoints and confirm endpoint data-handling policy before scanning sensitive targets.\n\n## Reference(s):\n\n- [ClawHub skill page](https://clawhub.ai/cyzlmh/skills/cmic-skill-scanner-linux-arm64)\n- [Installation guide](INSTALL.md)\n- [Build metadata](assets/build/build-info.json)\n\n## Skill Output:\n\n**Output Type(s):** [Text, Markdown, Files, Shell commands, Guidance]\n\n**Output Format:** [Markdown reports and terminal command guidance, with optional local report files.]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Optional upload and LLM review features require explicit endpoint configuration.]\n\n## Skill Version(s):\n\n0.11.1 (source: server release metadata; artifact build-info.json reports v0.11.1)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."},{"path":"assets/build/build-info.json","content":"{\n  \"version\": \"v0.11.1\",\n  \"target_os\": \"linux\",\n  \"target_arch\": \"arm64\",\n  \"binary_name\": \"skillscan\",\n  \"built_at_unix\": 1785134528,\n  \"checksum\": \"27f301c8f1a2ff32f3ee541b756658f1375c944bc3bf50df7778fc638a814220\"\n}"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1749,"uniquenessScore":40,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-10T10:09:30.474Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-10T13:32:27.623Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}