Skill: confidentkai/skill-vetter-optimized (version 2.0.0)

--- name: skill-vetter-optimized version: 2.0.0 description: "🔒 优化版技能审查器 - 安全优先的AI代理技能审查工具。在从ClawHub、GitHub或其他来源安装任何技能前使用。检查红标、权限范围和可疑模式。包含实用工具和系统化审查清单。基于原始skill-vetter优化，添加了Python检查脚本和详细审查流程。" --- # Skill Vetter Optimized 🔒✨ **优化版技能审查器** - 基于原始skill-vetter优化增强 ## 🚀 优化亮点 ✅ **新增实用工具** - Python检查脚本快速分析技能目录 ✅ **系统化审查流程** - 四阶段审查清单 ✅ **详细文档** - 完整的审查指南和示例 ✅ **保持兼容** - 完全兼容原始审查协议 ✅ **性能优化** - 更快的审查流程 Security-first vetting protocol for AI agent skills. **Never install a skill without vetting it first.** ## When to Use - Before installing any skill from ClawdHub - Before running skills from GitHub repos - When evaluating skills shared by other agents - Anytime you're asked to install unknown code ## Vetting Protocol ### Step 1: Source Check ``` Questions to answer: - [ ] Where did this skill come from? - [ ] Is the author known/reputable? - [ ] How many downloads/stars does it have? - [ ] When was it last updated? - [ ] Are there reviews from other agents? ``` ### Step 2: Code Review (MANDATORY) Read ALL files in the skill. Check for these **RED FLAGS**: ``` 🚨 REJECT IMMEDIATELY IF YOU SEE: ───────────────────────────────────────── • curl/wget to unknown URLs • Sends data to external servers • Requests credentials/tokens/API keys • Reads ~/.ssh, ~/.aws, ~/.config without clear reason • Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md • Uses base64 decode on anything • Uses eval() or exec() with external input • Modifies system files outside workspace • Installs packages without listing them • Network calls to IPs instead of domains • Obfuscated code (compressed, encoded, minified) • Requests elevated/sudo permissions • Accesses browser cookies/sessions • Touches credential files ───────────────────────────────────────── ``` ### Step 3: Permission Scope ``` Evaluate: - [ ] What files does it need to read? - [ ] What files does it need to write? - [ ] What commands does it run? - [ ] Does it need network access? To where? - [ ] Is the scope minimal for its stated purpose? ``` ### Step 4: Risk Classification | Risk Level | Examples | Action | |------------|----------|--------| | 🟢 LOW | Notes, weather, formatting | Basic review, install OK | | 🟡 MEDIUM | File ops, browser, APIs | Full code review required | | 🔴 HIGH | Credentials, trading, system | Human approval required | | ⛔ EXTREME | Security configs, root access | Do NOT install | ## Output Format After vetting, produce this report: ``` SKILL VETTING REPORT ═══════════════════════════════════════ Skill: [name] Source: [ClawdHub / GitHub / other] Author: [username] Version: [version] ─────────────────────────────────────── METRICS: • Downloads/Stars: [count] • Last Updated: [date] • Files Reviewed: [count] ─────────────────────────────────────── RED FLAGS: [None / List them] PERMISSIONS NEEDED: • Files: [list or "None"] • Network: [list or "None"] • Commands: [list or "None"] ─────────────────────────────────────── RISK LEVEL: [🟢 LOW / 🟡 MEDIUM / 🔴 HIGH / ⛔ EXTREME] VERDICT: [✅ SAFE TO INSTALL / ⚠️ INSTALL WITH CAUTION / ❌ DO NOT INSTALL] NOTES: [Any observations] ═══════════════════════════════════════ ``` ## 实用工具 ### 1. 技能检查脚本 使用内置的Python脚本快速检查技能目录： ```bash # 检查技能目录的基本信息和安全风险 python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill ``` ### 2. GitHub仓库检查 对于GitHub托管的技能： ```bash # 检查仓库统计信息 curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}' # 列出技能文件 curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name' # 获取并审查SKILL.md curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md" ``` ### 3. 使用审查清单 参考 `references/checklist.md` 进行系统化的技能审查。 ## Trust Hierarchy 1. **Official OpenClaw skills** → Lower scrutiny (still review) 2. **High-star repos (1000+)** → Moderate scrutiny 3. **Known authors** → Moderate scrutiny 4. **New/unknown sources** → Maximum scrutiny 5. **Skills requesting credentials** → Human approval always ## Remember - No skill is worth compromising security - When in doubt, don't install - Ask your human for high-risk decisions - Document what you vet for future reference --- *Paranoia is a feature.* 🔒🦀

path: CHANGELOG.md
content: # 更新日志 - Skill Vetter

## v2.0.0 (2026-04-15)

### 优化内容
1. **清理无关文件**
   - 删除 `_meta.json` (安装时生成的元数据文件)

2. **新增实用工具**
   - `scripts/skill_checker.py` - Python辅助检查脚本
   - `references/checklist.md` - 系统化审查清单

3. **更新SKILL.md**
   - 更新版本号至 2.0.0
   - 优化描述信息
   - 添加对新工具的说明
   - 保持核心审查协议完整

### 新增功能
1. **技能检查脚本** (`skill_checker.py`)
   - 快速检查技能目录结构
   - 提取SKILL.md元数据
   - 检测常见危险模式
   - 生成初步风险评估

2. **系统化审查清单** (`checklist.md`)
   - 四阶段审查流程
   - 详细的检查项目
   - 风险评估标准
   - 决策记录模板

### 核心功能保留
- 安全优先的审查协议
- 红标检测清单
- 权限范围评估
- 风险等级分类
- 信任层次结构

## v1.0.0 (原始版本)
- 初始版本发布
- 基本的技能审查协议
- 安全优先的设计理念

path: references/checklist.md
content: # 技能审查清单

## 第一阶段：基本信息检查

### 1. 来源验证
- [ ] **来源平台**: ClawHub / GitHub / 其他
- [ ] **作者信誉**: 已知作者 / 新作者 / 匿名
- [ ] **下载量/星标数**: 高(>1000) / 中(100-1000) / 低(<100)
- [ ] **最后更新**: 最近(30天内) / 较近(90天内) / 很久以前
- [ ] **许可证**: MIT / Apache / GPL / 其他 / 无

### 2. 文件结构检查
- [ ] **SKILL.md存在**: 是 / 否
- [ ] **描述清晰**: 是 / 否
- [ ] **版本号**: 有 / 无
- [ ] **目录结构合理**: 是 / 否
- [ ] **文件数量合理**: 是(≤20) / 否(>20)

## 第二阶段：代码安全审查

### 3. 危险模式检查 (立即拒绝如果发现)
- [ ] **下载并执行**: `curl | bash`, `wget | sh`
- [ ] **远程代码执行**: `eval()`, `exec()` 带外部输入
- [ ] **数据外传**: 发送数据到外部服务器
- [ ] **凭证访问**: 读取SSH密钥、API密钥、密码文件
- [ ] **系统修改**: 修改系统文件、crontab、启动项
- [ ] **权限提升**: `sudo`, `chmod 777`, `setuid`
- [ ] **混淆代码**: base64编码、压缩、混淆

### 4. 权限范围评估
- [ ] **文件读取**: 明确列出需要读取的文件
- [ ] **文件写入**: 明确列出需要写入的文件
- [ ] **网络访问**: 明确列出需要访问的域名/IP
- [ ] **命令执行**: 明确列出需要执行的命令
- [ ] **权限最小化**: 权限是否与功能匹配

### 5. 依赖检查
- [ ] **依赖声明**: package.json / requirements.txt
- [ ] **依赖安全性**: 已知漏洞检查
- [ ] **依赖必要性**: 所有依赖都是必要的吗？
- [ ] **依赖来源**: 官方源 / 第三方源

## 第三阶段：风险评估

### 6. 风险等级评估
- **🟢 低风险**: 只读操作、格式化、信息展示
- **🟡 中风险**: 文件操作、网络请求、API调用
- **🔴 高风险**: 系统命令、凭证访问、数据修改
- **⛔ 极高风险**: 提权操作、持久化、外传数据

### 7. 上下文评估
- [ ] **功能与权限匹配**: 是 / 否
- [ ] **错误处理**: 有 / 无
- [ ] **日志记录**: 有 / 无
- [ ] **测试用例**: 有 / 无
- [ ] **文档完整**: 是 / 否

## 第四阶段：决策与记录

### 8. 审查结论
- **✅ 安全可安装**: 通过所有检查，风险可控
- **⚠️ 谨慎安装**: 有中等风险，需要监控
- **❌ 拒绝安装**: 发现高风险或恶意行为

### 9. 记录保存
- [ ] **审查报告**: 生成详细报告
- [ ] **决策理由**: 记录通过/拒绝的理由
- [ ] **时间戳**: 记录审查时间
- [ ] **审查者**: 记录审查者信息

## 快速检查命令

```bash
# 使用辅助脚本检查
python3 /root/.openclaw/skills/skill-vetter/scripts/skill_checker.py /path/to/skill

# 检查GitHub仓库信息
curl -s "https://api.github.com/repos/owner/repo" | jq '.stargazers_count, .forks_count, .updated_at'

# 列出技能文件
find /path/to/skill -type f -name "*.py" -o -name "*.sh" -o -name "*.js"
```

## 注意事项

1. **零信任原则**: 默认不信任，需要验证
2. **最小权限**: 只授予必要的权限
3. **持续监控**: 安装后仍需监控行为
4. **及时更新**: 关注安全更新和漏洞
5. **备份恢复**: 重要系统做好备份

---

*安全不是功能，而是基础。* 🔒

path: scripts/skill_checker.py
content: #!/usr/bin/env python3
"""
Skill Vetter Helper Script
辅助工具，用于快速检查技能的基本信息和安全风险
"""

import os
import sys
import json
import re
from pathlib import Path

def check_skill_directory(skill_path):
    """检查技能目录的基本信息"""
    skill_path = Path(skill_path)
    
    if not skill_path.exists():
        print(f"错误: 路径不存在: {skill_path}")
        return None
    
    print(f"检查技能目录: {skill_path}")
    print("=" * 60)
    
    # 检查SKILL.md文件
    skill_md = skill_path / "SKILL.md"
    if skill_md.exists():
        print(f"✅ 找到 SKILL.md")
        with open(skill_md, 'r', encoding='utf-8') as f:
            content = f.read(2000)  # 只读取前2000字符
            
            # 提取元数据
            if content.startswith('---'):
                meta_end = content.find('---', 3)
                if meta_end != -1:
                    meta_content = content[3:meta_end]
                    print("📋 技能元数据:")
                    for line in meta_content.strip().split('\n'):
                        if ':' in line:
                            key, value = line.split(':', 1)
                            print(f"   {key.strip()}: {value.strip()}")
    else:
        print(f"❌ 未找到 SKILL.md 文件")
    
    # 列出所有文件
    print("\n📁 目录结构:")
    file_count = 0
    script_files = []
    
    for root, dirs, files in os.walk(skill_path):
        level = root.replace(str(skill_path), '').count(os.sep)
        indent = ' ' * 2 * level
        print(f"{indent}{os.path.basename(root)}/")
        subindent = ' ' * 2 * (level + 1)
        
        for file in files:
            file_count += 1
            file_path = os.path.join(root, file)
            rel_path = os.path.relpath(file_path, skill_path)
            
            # 检查脚本文件
            if file.endswith(('.py', '.sh', '.js', '.ts')):
                script_files.append(rel_path)
                print(f"{subindent}🔧 {file}")
            elif file.endswith('.md'):
                print(f"{subindent}📝 {file}")
            elif file.endswith('.json'):
                print(f"{subindent}📊 {file}")
            else:
                print(f"{subindent}{file}")
    
    print(f"\n📊 统计信息:")
    print(f"   总文件数: {file_count}")
    print(f"   脚本文件: {len(script_files)}")
    if script_files:
        print(f"   脚本列表: {', '.join(script_files)}")
    
    # 快速安全检查
    print("\n🔍 快速安全检查:")
    
    red_flags = []
    for script in script_files:
        script_path = skill_path / script
        try:
            with open(script_path, 'r', encoding='utf-8', errors='ignore') as f:
                content = f.read()
                
                # 检查危险模式
                checks = [
                    ("curl.*\\|.*bash", "curl管道到bash"),
                    ("wget.*\\|.*sh", "wget管道到sh"),
                    ("eval\\s*\\(.*\\)", "eval函数调用"),
                    ("exec\\s*\\(.*\\)", "exec函数调用"),
                    ("base64.*decode", "base64解码"),
                    ("requests\\.(get|post)", "网络请求"),
                    ("subprocess\\.run", "子进程执行"),
                    ("os\\.system", "系统命令执行"),
                    ("chmod.*777", "危险权限设置"),
                    ("sudo", "sudo命令"),
                ]
                
                for pattern, desc in checks:
                    if re.search(pattern, content, re.IGNORECASE):
                        red_flags.append(f"{script}: {desc}")
                        
        except Exception as e:
            print(f"   无法读取 {script}: {e}")
    
    if red_flags:
        print("   ⚠️  发现潜在风险:")
        for flag in red_flags:
            print(f"      • {flag}")
    else:
        print("   ✅ 未发现明显的危险模式")
    
    print("\n" + "=" * 60)
    return {
        "path": str(skill_path),
        "has_skill_md": skill_md.exists(),
        "file_count": file_count,
        "script_count": len(script_files),
        "red_flags": red_flags
    }

def main():
    if len(sys.argv) < 2:
        print("用法: python3 skill_checker.py <技能目录路径>")
        print("示例: python3 skill_checker.py /path/to/skill")
        sys.exit(1)
    
    skill_path = sys.argv[1]
    result = check_skill_directory(skill_path)
    
    if result:
        print("\n🎯 检查完成!")
        print(f"技能路径: {result['path']}")
        print(f"SKILL.md: {'✅ 存在' if result['has_skill_md'] else '❌ 缺失'}")
        print(f"文件总数: {result['file_count']}")
        print(f"脚本文件: {result['script_count']}")
        print(f"风险标记: {len(result['red_flags'])} 个")
        
        if result['red_flags']:
            print("\n⚠️  建议进行详细的安全审查!")
        else:
            print("\n✅ 初步检查通过，但仍建议进行完整审查")

if __name__ == "__main__":
    main()

Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)