{"id":"661059dc-031b-4781-a35f-3b9ffc700d56","slug":"clawhub-fyniujin-skill-security-checker","name":"skill-security-checker","description":"Skill Security — 安全审计扫描器，审一下这个 skill、装之前帮我查查、这个 skill 安全吗？一键快扫 30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 风险 + 一句话理由；全量模式覆盖轻量 SAST 污点追踪（Python AST + JS 词法近似，source→sink 证据链降误报）、规则引擎（YAML 规则包热插拔扩展）、社区规则（schema 校验 + 来源记录 + 签名验证）、提示注入 ML 语义检测（ONNX + 正则降级）、系统级行为捕获（eBPF Linux / ETW Windows）、动态沙箱执行扫描、供应链风险分析、OSV.dev 离线数据包（全生态 CVE 覆盖，零密钥）+ 锁文件深度解析（requirements.txt / package-lock.json / poetry.lock，版本区间级精确匹配）、恶意 Skill 指纹库、健康度与合规检查（质量+结构+权限合并）、全局排除配置、CI/CD 集成、JSON/HTML/SARIF 报告生成。","canonicalUrl":"https://www.xpersona.co/agent/clawhub-fyniujin-skill-security-checker","sourceUrl":"https://clawhub.ai/fyniujin/skill-security-checker","homepage":"https://clawhub.ai/fyniujin/skills/skill-security-checker","source":"CLAWHUB","vendor":{"slug":"clawhub","label":"Clawhub","url":"https://clawhub.ai/fyniujin/skills/skill-security-checker"},"protocols":["OPENCLEW"],"capabilities":[],"trustScore":null,"trustConfidence":"unknown","artifactCount":0,"benchmarkCount":0,"lastRelease":"3.5.5","freshnessAt":"2026-10-11T03:08:59.159Z","freshnessLabel":"Oct 11, 2026","securityReviewed":true,"openapiReady":false,"stats":[{"label":"Trust score","value":"Unknown"},{"label":"Compatibility","value":"OpenClaw"},{"label":"Freshness","value":"Oct 11, 2026"},{"label":"Vendor","value":"Clawhub"},{"label":"Artifacts","value":"0"},{"label":"Benchmarks","value":"0"},{"label":"Last release","value":"3.5.5"}],"factsPreview":[{"factKey":"vendor","category":"vendor","label":"Vendor","value":"Clawhub","href":"https://clawhub.ai/fyniujin/skills/skill-security-checker","sourceUrl":"https://clawhub.ai/fyniujin/skills/skill-security-checker","sourceType":"profile","confidence":"medium","observedAt":"2026-10-11T03:08:59.174Z","isPublic":true},{"factKey":"protocols","category":"compatibility","label":"Protocol compatibility","value":"OpenClaw","href":"https://www.xpersona.co/api/v1/agents/clawhub-fyniujin-skill-security-checker/contract","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-fyniujin-skill-security-checker/contract","sourceType":"contract","confidence":"medium","observedAt":"2026-10-11T03:08:59.174Z","isPublic":true},{"factKey":"traction","category":"adoption","label":"Adoption signal","value":"1.2K downloads","href":"https://clawhub.ai/fyniujin/skill-security-checker","sourceUrl":"https://clawhub.ai/fyniujin/skill-security-checker","sourceType":"profile","confidence":"medium","observedAt":"2026-10-11T03:08:59.174Z","isPublic":true},{"factKey":"latest_release","category":"release","label":"Latest release","value":"3.5.5","href":"https://clawhub.ai/fyniujin/skill-security-checker","sourceUrl":"https://clawhub.ai/fyniujin/skill-security-checker","sourceType":"release","confidence":"medium","observedAt":"2026-10-09T11:19:45.736Z","isPublic":true},{"factKey":"handshake_status","category":"security","label":"Handshake status","value":"UNKNOWN","href":"https://www.xpersona.co/api/v1/agents/clawhub-fyniujin-skill-security-checker/trust","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-fyniujin-skill-security-checker/trust","sourceType":"trust","confidence":"medium","observedAt":null,"isPublic":true}],"highlights":["1.2K downloads","Trust evidence available"],"agentCard":{"name":"skill-security-checker","description":"Skill Security — 安全审计扫描器，审一下这个 skill、装之前帮我查查、这个 skill 安全吗？一键快扫 30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 风险 + 一句话理由；全量模式覆盖轻量 SAST 污点追踪（Python AST + JS 词法近似，source→sink 证据链降误报）、规则引擎（YAML 规则包热插拔扩展）、社区规则（schema 校验 + 来源记录 + 签名验证）、提示注入 ML 语义检测（ONNX + 正则降级）、系统级行为捕获（eBPF Linux / ETW Windows）、动态沙箱执行扫描、供应链风险分析、OSV.dev 离线数据包（全生态 CVE 覆盖，零密钥）+ 锁文件深度解析（requirements.txt / package-lock.json / poetry.lock，版本区间级精确匹配）、恶意 Skill 指纹库、健康度与合规检查（质量+结构+权限合并）、全局排除配置、CI/CD 集成、JSON/HTML/SARIF 报告生成。","source":"CLAWHUB","sourceId":"clawhub:s177r8w7p1d7cpbys9bn33kwhs89d0xw:skill-security-checker","homepage":"https://clawhub.ai/fyniujin/skills/skill-security-checker","repository":"https://clawhub.ai/fyniujin/skill-security-checker","documentation":"https://www.xpersona.co/agent/clawhub-fyniujin-skill-security-checker","protocols":["OPENCLEW"],"examples":[{"kind":"example","language":"bash","snippet":"# 1. 快扫：30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 + 一句话理由\npython D:\\skill\\skill-security-checker\\scripts\\audit.py \"D:\\skill\\你的技能名\" --quick\n# 2. 全量：CI/CD 用 JSON/SARIF，安全工程师看 HTML\npython D:\\skill\\skill-security-checker\\scripts\\audit.py \"D:\\skill\\你的技能名\" --mode full --format sarif -o report.sarif.json\n# 3. 口语触发：直接对 WorkBuddy 说「审一下这个 skill」+ 路径，自动快扫"},{"kind":"example","language":"python","snippet":"# 这行会被扫描器跳过\nos.system('ls')  # nosec"}]}}