Claude/OpenClaw技能安全审计工具 - 检测恶意技能，保障AI助手供应链安全

skill-security-audit by smartchainark/skill-security-audit

329 周安装量

8 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/smartchainark/skill-security-audit --skill skill-security-audit

自动化命令行工具安全

🇨🇳中文介绍

技能安全审计

检测已安装 Claude 和 OpenClaw 技能中的恶意模式。基于 SlowMist 对 ClawHub 平台上 472+ 恶意技能的分析。

触发条件

当用户提及以下内容时使用此技能：安全审计, security audit, skill 检查, 技能安全, scan skills, supply chain security, 扫描技能, 恶意检测, malicious skill, skill 安全扫描

快速审计工作流

当用户请求安全审计时，请遵循以下 5 个步骤：

步骤 1：运行扫描器

python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py

这将自动发现并扫描以下位置中的所有技能：

~/.claude/skills/
~/.openclaw/workspace/skills/
来自 ~/.openclaw/openclaw.json → skills.load.extraDirs 的额外目录

步骤 2：分析结果

读取扫描器输出。发现的问题按技能分组并按严重性排序：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

步骤 3：向用户报告

按以下格式呈现发现的问题：

## 审计摘要
- 已扫描技能数：N
- 已扫描文件数：N
- CRITICAL：N | HIGH：N | MEDIUM：N | LOW：N

## 关键/高风险发现（如果有）
针对每个发现：
- 技能名称和文件路径
- 检测到的内容及其危险性原因
- 建议操作

## 中/低风险发现（如果有）
简要摘要，指出哪些可能是误报

步骤 4：建议操作

对于 CRITICAL 发现：

阅读 references/remediation-guide.md 获取事件响应步骤
如果检测到凭据窃取，指导用户完成凭据轮换
帮助隔离恶意技能

对于 HIGH 发现：

帮助用户手动审查标记的代码
判断该模式在上下文中是合法的还是恶意的

步骤 5：后续跟进

提供详细扫描特定技能的功能：python3 skill_audit.py --path /path/to/skill
提供使用 references/threat-patterns.md 深入解释任何发现的功能

扫描器命令参考

# 扫描所有发现的技能
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py

# 扫描单个技能目录
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --path /path/to/skill

# JSON 输出（供编程使用）
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --json

# 按最低严重性过滤
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --severity high

# 禁用彩色输出
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --no-color

# 使用自定义 IOC 数据库
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --ioc-db /path/to/ioc.json

退出代码： 0 = 干净，1 = 低/中风险，2 = 高风险，3 = 关键风险，4 = 扫描器错误

检测器	检测内容	严重性
Base64Detector	编码字符串 >50 字符（排除 data:image）	MEDIUM→HIGH
DownloadExecDetector	curl	bash, wget
IOCMatchDetector	已知恶意 IP、域名、URL、文件哈希	CRITICAL
ObfuscationDetector	使用非字面量参数的 eval/exec、十六进制编码、chr() 链	HIGH
ExfiltrationDetector	ZIP+上传组合、敏感目录枚举	HIGH
CredentialTheftDetector	osascript 密码对话框、钥匙串访问、SSH 密钥读取	CRITICAL
PersistenceDetector	crontab, launchd, systemd, shell 配置文件修改	HIGH
PostInstallHookDetector	npm postinstall, pip setup.py cmdclass	HIGH→CRITICAL
HiddenCharDetector	零宽字符、Unicode 双向覆盖	MEDIUM
EntropyDetector	长行的香农熵 >5.5	MEDIUM
SocialEngineeringDetector	crypto/wallet/airdrop/security-update 命名	LOW→MEDIUM
NetworkCallDetector	socket, http, urllib, requests, fetch, curl, wget	MEDIUM
PrivilegeEscalationDetector	sudo, chmod 777, setuid, admin 组修改	HIGH

理解置信度分数

每个发现都包含一个置信度分数（0-100）：

80-100 ：极有可能是真实威胁
50-79 ：可疑，建议手动审查
30-49 ：可能是误报，检查上下文
< 30：信息性，置信度低

当扫描器标记出问题时，还需检查：

来源验证 —— 该技能是否来自官方/已验证来源？检查作者声誉。
权限范围 —— 该技能请求的权限是否超出了其声明功能所需？
脚本审计 —— 阅读所有 .sh、.py、.js 文件。查找混淆、意外的网络调用。
依赖项检查 —— 如果技能有包依赖项，运行 npm audit 或 pip-audit。
变更日志审查 —— 最近的更新中是否引入了可疑更改？

更新 IOC 数据库

IOC 数据库位于 scripts/ioc_database.json。要添加新指标：

按照现有模式编辑 JSON 文件
运行扫描器以验证您的新 IOC 是否被检测到
更新 references/ioc-database.md 以保持人类可读版本同步

如需详细信息，请根据需要阅读以下文件：

references/ioc-database.md —— 包含上下文和归属的完整 IOC 列表
references/threat-patterns.md —— 详细说明 9 种攻击模式（两阶段载荷、Base64 后门、密码钓鱼等）
references/remediation-guide.md —— 分步事件响应指南（隔离、凭据轮换、持久化清理、报告）

🇺🇸English

Skill Security Audit

Detect malicious patterns in installed Claude and OpenClaw skills. Based on SlowMist's analysis of 472+ malicious skills on ClawHub platform.

Triggers

Use this skill when the user mentions: 安全审计, security audit, skill 检查, 技能安全, scan skills, supply chain security, 扫描技能, 恶意检测, malicious skill, skill 安全扫描

Quick Audit Workflow

When the user requests a security audit, follow these 5 steps:

Step 1: Run the Scanner

python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py

This auto-discovers and scans all skills in:

~/.claude/skills/
~/.openclaw/workspace/skills/
Extra directories from ~/.openclaw/openclaw.json → skills.load.extraDirs

Step 2: Analyze Results

Read the scanner output. Findings are grouped by skill and sorted by severity:

Severity	Meaning	Action Required
CRITICAL	Known malicious IOC match, credential theft, or download-and-execute	Immediate removal and credential rotation
HIGH	Obfuscation, persistence mechanisms, privilege escalation	Manual review required, likely malicious
MEDIUM	Suspicious patterns (Base64, network calls, high entropy)	Review context — may be legitimate
LOW	Social engineering naming, informational	Note for awareness

Step 3: Report to User

Present findings in this format:

## Audit Summary
- Skills scanned: N
- Files scanned: N
- CRITICAL: N | HIGH: N | MEDIUM: N | LOW: N

## Critical/High Findings (if any)
For each finding:
- Skill name and file path
- What was detected and why it's dangerous
- Recommended action

## Medium/Low Findings (if any)
Brief summary, noting which are likely false positives

Step 4: Recommend Actions

For CRITICAL findings:

Read references/remediation-guide.md for incident response steps
Guide user through credential rotation if credential theft was detected
Help quarantine the malicious skill

For HIGH findings:

Help user manually review the flagged code
Determine if the pattern is legitimate or malicious in context

Step 5: Follow Up

Offer to scan a specific skill in detail: python3 skill_audit.py --path /path/to/skill
Offer to explain any finding in depth using references/threat-patterns.md

Scanner Command Reference

# Scan all discovered skills
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py

# Scan a single skill directory
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --path /path/to/skill

# JSON output (for programmatic use)
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --json

# Filter by minimum severity
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --severity high

# Disable colored output
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --no-color

# Use custom IOC database
python3 ~/.claude/skills/skill-security-audit/scripts/skill_audit.py --ioc-db /path/to/ioc.json

Exit codes: 0 = clean, 1 = low/medium risk, 2 = high risk, 3 = critical, 4 = scanner error

13 Detection Categories

Detector	What It Finds	Severity
Base64Detector	Encoded strings >50 chars (excluding data:image)	MEDIUM→HIGH
DownloadExecDetector	curl	bash, wget
IOCMatchDetector	Known malicious IPs, domains, URLs, file hashes	CRITICAL
ObfuscationDetector	eval/exec with non-literal args, hex encoding, chr() chains	HIGH
ExfiltrationDetector	ZIP+upload combos, sensitive directory enumeration	HIGH
CredentialTheftDetector	osascript password dialogs, keychain access, SSH key reading	CRITICAL
PersistenceDetector	crontab, launchd, systemd, shell profile modification	HIGH
PostInstallHookDetector	npm postinstall, pip setup.py cmdclass	HIGH→CRITICAL
HiddenCharDetector

Understanding Confidence Scores

Each finding includes a confidence score (0-100):

80-100 : Very likely a genuine threat
50-79 : Suspicious, manual review recommended
30-49 : Possible false positive, check context
< 30: Informational, low confidence

Manual Review Checklist

When the scanner flags something, also check:

Source verification — Is the skill from an official/verified source? Check author reputation.
Permission scope — Does the skill request more permissions than its stated functionality needs?
Script audit — Read all .sh, .py, .js files. Look for obfuscation, unexpected network calls.
Dependency check — Run npm audit or pip-audit if the skill has package dependencies.
Changelog review — Were suspicious changes introduced in a recent update?

Updating the IOC Database

The IOC database is at scripts/ioc_database.json. To add new indicators:

Edit the JSON file following the existing schema
Run the scanner to verify your new IOCs are detected
Update references/ioc-database.md to keep the human-readable version in sync

Reference Documents

For detailed information, read these files as needed:

references/ioc-database.md — Full IOC list with context and attribution
references/threat-patterns.md — 9 attack patterns in detail (two-stage payload, Base64 backdoor, password phishing, etc.)
references/remediation-guide.md — Step-by-step incident response (quarantine, credential rotation, persistence cleanup, reporting)

Weekly Installs

329

Repository

smartchainark/s…ty-audit

GitHub Stars

First Seen

Feb 10, 2026

Security Audits

Gen Agent Trust HubFail SocketWarn SnykPass

Installed on

opencode322

codex322

gemini-cli321

kimi-cli321

github-copilot321

amp321

通过 LiteLLM 代理让 Claude Code 对接 GitHub Copilot 运行 | 高级变通方案指南

22,200 周安装

CRITICAL	已知恶意 IOC 匹配、凭据窃取或下载并执行	立即移除并轮换凭据
HIGH	混淆、持久化机制、权限提升	需要手动审查，很可能为恶意
MEDIUM	可疑模式（Base64、网络调用、高熵值）	审查上下文——可能是合法的
LOW	社会工程学命名、信息性	注意了解