{"id":"d2b25ea0-28c4-4db7-aa71-ce99a61f2a9b","slug":"clawhub-zhaobod1-huo15-openclaw-security-review","name":"Huo15 Openclaw Security Review","description":"对当前分支的 pending changes 做安全评审，命中密钥泄露 / SQL 注入 / XSS / SSRF / 权限绕过 / 危险依赖 六大类漏洞后出分级报告，再在用户批准下修复。用于 PR 合并前、对外开源前、线上事故后复盘。触发词：安全评审、security review、漏洞检查、密钥扫描、我的代码...","canonicalUrl":"https://www.xpersona.co/agent/clawhub-zhaobod1-huo15-openclaw-security-review","sourceUrl":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","homepage":"https://clawhub.ai/zhaobod1/skills/huo15-openclaw-security-review","source":"CLAWHUB","vendor":{"slug":"clawhub","label":"Clawhub","url":"https://clawhub.ai/zhaobod1/skills/huo15-openclaw-security-review"},"protocols":["OPENCLEW"],"capabilities":[],"trustScore":null,"trustConfidence":"unknown","artifactCount":0,"benchmarkCount":0,"lastRelease":"1.0.0","freshnessAt":"2026-10-12T00:43:14.656Z","freshnessLabel":"Oct 12, 2026","securityReviewed":true,"openapiReady":false,"stats":[{"label":"Trust score","value":"Unknown"},{"label":"Compatibility","value":"OpenClaw"},{"label":"Freshness","value":"Oct 12, 2026"},{"label":"Vendor","value":"Clawhub"},{"label":"Artifacts","value":"0"},{"label":"Benchmarks","value":"0"},{"label":"Last release","value":"1.0.0"}],"factsPreview":[{"factKey":"vendor","category":"vendor","label":"Vendor","value":"Clawhub","href":"https://clawhub.ai/zhaobod1/skills/huo15-openclaw-security-review","sourceUrl":"https://clawhub.ai/zhaobod1/skills/huo15-openclaw-security-review","sourceType":"profile","confidence":"medium","observedAt":"2026-10-12T00:43:14.668Z","isPublic":true},{"factKey":"protocols","category":"compatibility","label":"Protocol compatibility","value":"OpenClaw","href":"https://www.xpersona.co/api/v1/agents/clawhub-zhaobod1-huo15-openclaw-security-review/contract","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-zhaobod1-huo15-openclaw-security-review/contract","sourceType":"contract","confidence":"medium","observedAt":"2026-10-12T00:43:14.668Z","isPublic":true},{"factKey":"traction","category":"adoption","label":"Adoption signal","value":"966 downloads","href":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","sourceUrl":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","sourceType":"profile","confidence":"medium","observedAt":"2026-10-12T00:43:14.668Z","isPublic":true},{"factKey":"latest_release","category":"release","label":"Latest release","value":"1.0.0","href":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","sourceUrl":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","sourceType":"release","confidence":"medium","observedAt":"2026-04-24T14:34:44.651Z","isPublic":true},{"factKey":"handshake_status","category":"security","label":"Handshake status","value":"UNKNOWN","href":"https://www.xpersona.co/api/v1/agents/clawhub-zhaobod1-huo15-openclaw-security-review/trust","sourceUrl":"https://www.xpersona.co/api/v1/agents/clawhub-zhaobod1-huo15-openclaw-security-review/trust","sourceType":"trust","confidence":"medium","observedAt":null,"isPublic":true}],"highlights":["966 downloads","Trust evidence available"],"agentCard":{"name":"Huo15 Openclaw Security Review","description":"对当前分支的 pending changes 做安全评审，命中密钥泄露 / SQL 注入 / XSS / SSRF / 权限绕过 / 危险依赖 六大类漏洞后出分级报告，再在用户批准下修复。用于 PR 合并前、对外开源前、线上事故后复盘。触发词：安全评审、security review、漏洞检查、密钥扫描、我的代码...","source":"CLAWHUB","sourceId":"clawhub:s17f6q72skfgyjycm2frgdc8dn83v5mk:huo15-openclaw-security-review","homepage":"https://clawhub.ai/zhaobod1/skills/huo15-openclaw-security-review","repository":"https://clawhub.ai/zhaobod1/huo15-openclaw-security-review","documentation":"https://www.xpersona.co/agent/clawhub-zhaobod1-huo15-openclaw-security-review","protocols":["OPENCLEW"],"examples":[{"kind":"example","language":"markdown","snippet":"## 安全评审报告 — <branch> vs main\n\n**扫描范围**：12 个文件变更 · 扫描时间 2s\n\n### 🔴 Critical（1 项，必须修）\n1. **[Secrets]** `src/config.ts:18` — 硬编码 OpenAI API key\n   - 信号：`sk-proj-...` 匹配\n   - CWE-798（硬编码凭据）\n   - 修复：移入 `.env`；**立刻在 OpenAI 后台 revoke 此 key**\n   - 若已推送：`git filter-repo` 清历史 + force push\n\n### 🟠 High（2 项）\n2. **[Injection]** `src/api/search.ts:45` — SQL 拼接用户输入\n3. **[Auth]** `src/api/order/[id].ts:12` — 缺归属校验（IDOR）\n\n### 🟡 Medium（1 项）\n4. **[XSS]** `components/Post.tsx:33` — dangerouslySetInnerHTML 渲染用户 markdown，未跑 DOMPurify\n\n### 🟢 Low（1 项）\n5. **[Dependency]** `package.json` — `lodash@4.17.15` 有 2 个 low CVE；建议升 4.17.21\n\n### 建议跑（用户执行）"}]}}