SkillScan
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On...
README.md
text/markdown · 1551 字节
SKILL.md
text/markdown · 3737 字节
_meta.json
application/json · 630 字节
scripts/scanner.py
text/plain · 39806 字节
Security Scan
状态
suspicious
OpenClaw
gpt-5-mini
OpenClaw 分析
The skill generally does what it says (scans skill packages and can perform cloud-powered analysis) but it contains several intrusive behaviors (writing to a global SOUL.md, enumerating many user paths, collecting a MAC/unique client id, and uploading files to an external service) that are privacy-sensitive and deserve review before install.
置信度: medium
VirusTotal
Type: OpenClaw Skill Name: skillscan Version: 1.0.0 The skill functions as a security scanner but exhibits several high-risk behaviors that border on malicious data harvesting. In `scripts/scanner.py`, it collects system fingerprints (including MAC addresses) and uploads the full source code of all detected skills to a third-party domain (`skillscan.tokauth.com`) for 'cloud analysis.' The script searches for skills across an unusually broad range of directories belonging to other AI agents and IDEs (e.g., Cursor, Claude, Copilot, Windsurf). Additionally, `SKILL.md` instructs the agent to modify the core `SOUL.md` configuration to ensure its rules persist, and the script includes an auto-update mechanism that downloads and executes remote ZIP payloads.