Skill Vetter: 安全 AI 智能体扩展审计 - Openclaw Skills

下载入口:https://github.com/openclaw/skills/tree/main/skills/spclaudehome/skill-vetter

安装与下载

1. ClawHub CLI

从源直接安装技能的最快方式。

npx clawhub@latest install skill-vetter

2. 手动安装

将技能文件夹复制到以下位置之一

全局模式 ~/.openclaw/skills/ 工作区 <project>/skills/

优先级：工作区 > 本地 > 内置

3. 提示词安装

将此提示词复制到 OpenClaw 即可自动安装。

请帮我使用 Clawhub 安装 skill-vetter。如果尚未安装 Clawhub，请先安装（npm i -g clawhub）。

什么是 Skill Vetter？

Skill Vetter 是 AI 智能体开发者和用户的核心安全层。它提供了一个标准化的框架来评估第三方扩展，确保没有恶意代码进入您的工作空间。通过系统地检查红线问题（如未经授权的网络调用、凭据访问和混淆代码），该工具可以保护您的数据和系统完整性。

将此协议集成到您的工作流程中，可确保您部署的任何 Openclaw Skills 都经过彻底的安全检查。它将安装社区贡献工具的风险过程转化为结构化、安全优先的工作流，强调了安全是智能体生态系统中不可逾越的底线。

Skill Vetter 应用场景

• 在从 ClawdHub 或社区仓库安装任何新扩展之前。
• 在多智能体环境中评估智能体之间共享的技能。
• 在运行远程代码之前审计 GitHub 仓库。
• 评估请求敏感文件系统权限或 API 令牌的技能安全性。

Skill Vetter 工作原理

1. 来源验证：分析技能的来源、作者声誉和社区参与度指标。
2. 强制代码审查：对所有技能文件进行深度扫描，识别 suspicious 模式，如 base64 解码、eval() 调用或隐藏的外部网络请求。
3. 权限映射：评估请求的文件系统和网络范围，确保其最小化并符合技能声明的用途。
4. 风险分类：根据对宿主系统的潜在影响，将技能风险分为低、中、高、极端四个等级。
5. 报告生成：生成包含最终安全结论的标准技能审计报告。

Skill Vetter 配置指南

Skill Vetter 协议依赖于标准的命令行工具，如 curl 和 jq 进行仓库分析。要开始审核托管在 GitHub 上的 Openclaw Skills，您可以使用以下调查命令：

# 检查仓库元数据和活跃度
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# 列出特定技能目录下的所有文件
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# 获取并手动检查 SKILL.md 定义文件
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

Skill Vetter 数据架构与分类体系

Skill Vetter 将发现结果整理成结构化报告，以确保不同 Openclaw Skills 之间的一致性。架构包括：

属性	描述
指标	定量数据，包括星数、更新频率和审查的文件。
红线	审查过程中发现的关键安全违规或可疑代码模式列表。
权限	文件、网络和 CLI 命令请求访问的详细列表。
风险等级	定性评级：低（备注/天气）、中（浏览器/API）、高（凭证）或极端（Root 权限）。
结论	最终建议：安全安装、谨慎安装或禁止安装。

name: skill-vetter
version: 1.0.0
description: Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

Skill Vetter ??

Security-first vetting protocol for AI agent skills. Never install a skill without vetting it first.

When to Use

• Before installing any skill from ClawdHub
• Before running skills from GitHub repos
• When evaluating skills shared by other agents
• Anytime you're asked to install unknown code

Vetting Protocol

Step 1: Source Check

Questions to answer:
- [ ] Where did this skill come from?
- [ ] Is the author known/reputable?
- [ ] How many downloads/stars does it have?
- [ ] When was it last updated?
- [ ] Are there reviews from other agents?

Step 2: Code Review (MANDATORY)

Read ALL files in the skill. Check for these RED FLAGS:

?? REJECT IMMEDIATELY IF YOU SEE:
─────────────────────────────────────────
? curl/wget to unknown URLs
? Sends data to external servers
? Requests credentials/tokens/API keys
? Reads ~/.ssh, ~/.aws, ~/.config without clear reason
? Accesses MEMORY.md, USER.md, SOUL.md, IDENTITY.md
? Uses base64 decode on anything
? Uses eval() or exec() with external input
? Modifies system files outside workspace
? Installs packages without listing them
? Network calls to IPs instead of domains
? Obfuscated code (compressed, encoded, minified)
? Requests elevated/sudo permissions
? Accesses browser cookies/sessions
? Touches credential files
─────────────────────────────────────────

Step 3: Permission Scope

Evaluate:
- [ ] What files does it need to read?
- [ ] What files does it need to write?
- [ ] What commands does it run?
- [ ] Does it need network access? To where?
- [ ] Is the scope minimal for its stated purpose?

Step 4: Risk Classification

Output Format

After vetting, produce this report:

SKILL VETTING REPORT
═══════════════════════════════════════
Skill: [name]
Source: [ClawdHub / GitHub / other]
Author: [username]
Version: [version]
───────────────────────────────────────
METRICS:
? Downloads/Stars: [count]
? Last Updated: [date]
? Files Reviewed: [count]
───────────────────────────────────────
RED FLAGS: [None / List them]

PERMISSIONS NEEDED:
? Files: [list or "None"]
? Network: [list or "None"]  
? Commands: [list or "None"]
───────────────────────────────────────
RISK LEVEL: [?? LOW / ?? MEDIUM / ?? HIGH / ? EXTREME]

VERDICT: [? SAFE TO INSTALL / ?? INSTALL WITH CAUTION / ? DO NOT INSTALL]

NOTES: [Any observations]
═══════════════════════════════════════

Quick Vet Commands

For GitHub-hosted skills:

# Check repo stats
curl -s "https://api.github.com/repos/OWNER/REPO" | jq '{stars: .stargazers_count, forks: .forks_count, updated: .updated_at}'

# List skill files
curl -s "https://api.github.com/repos/OWNER/REPO/contents/skills/SKILL_NAME" | jq '.[].name'

# Fetch and review SKILL.md
curl -s "https://raw.githubusercontent.com/OWNER/REPO/main/skills/SKILL_NAME/SKILL.md"

Trust Hierarchy

1. Official OpenClaw skills → Lower scrutiny (still review)
2. High-star repos (1000+) → Moderate scrutiny
3. Known authors → Moderate scrutiny
4. New/unknown sources → Maximum scrutiny
5. Skills requesting credentials → Human approval always

Remember

• No skill is worth compromising security
• When in doubt, don't install
• Ask your human for high-risk decisions
• Document what you vet for future reference

---

Paranoia is a feature. ????