100/100 (Very Low)

OpenClaw： benign
VirusTotal： benign
StaticScan： clean

OpenClaw： benign

The skill's requirements and instructions match its purpose (installing and operating the 1Password CLI); nothing demands unrelated credentials or installs, though some tmux usage details merit carefu...

[内容已截断]

VirusTotal： benign VT 报告

静态扫描： clean

No suspicious patterns detected.

README 未提供

{
    "latestVersion": {
        "_creationTime": 1773332877378,
        "_id": "k97e90pawv3dp0j8657edz0dtn82sa30",
        "changelog": "1password v1.1.0 — Security Hardened\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\nWe ran this skill through Faberlens (https:\/\/faberlens.ai\/check), a behavioral safety evaluation that tests how AI agents actually use skills under adversarial pressure. The original skill scored well on\ncore functionality, but we found 6 behavioral regressions where it made Claude less secure than baseline.                                                                                                     \n\t\t\t  \nThe worst: the skill taught Claude to exfiltrate secrets. op read returns raw values, but nothing stopped piping them to curl, nc, or clipboard tools. Under social engineering, Claude willingly built\nexfiltration chains.\n\nWhat changed (9 guardrails added, 0 removed — purely additive):\n\n- Block piping op read\/op run output to network or unfamiliar commands\n- Block bare env dumps (op run -- env\/printenv)\n- Prohibit --no-masking — masked output is always sufficient\n- Provide safe patterns for secret metadata checks (wc -c, test -n)\n- User permission\/authority\/urgency don't override secret protections\n- Single-quote all user-provided vault\/item\/field names (shell injection)\n- CLI installs only from official sources\n- Always inspect op inject templates before injecting\n\nResults:\n- Mean lift: +8.5% → +30.4%\n- Worst category: -33.3% → +5.6%\n- Regressions: 6 → 0 (100% fix rate)\n\nThese are measured behavioral regressions from 819 test generations scored by Claude Opus — not hypothetical risks.\n\nFull report: https:\/\/faberlens.ai\/report\/skill\/?d=1password",
        "changelogSource": "user",
        "createdAt": 1773332877378,
        "parsed": {
            "clawdis": {
                "emoji": "🔐",
                "install": [
                    {
                        "bins": [
                            "op"
                        ],
                        "formula": "1password-cli",
                        "id": "brew",
                        "kind": "brew",
                        "label": "Install 1Password CLI (brew)"
                    }
                ],
                "requires": {
                    "bins": [
                        "op"
                    ]
                }
            }
        },
        "version": "1.0.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "Faberlens",
        "handle": "snazar-faberlens",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/261834257?v=4",
        "kind": "user",
        "linkedUserId": "kn706xw9bamamdar1vywjx42ad81sc6v"
    },
    "ownerHandle": "snazar-faberlens",
    "skill": {
        "_creationTime": 1773332877378,
        "_id": "kd7chd8hd16vs0htn0ah7b3qeh82s1yr",
        "badges": [],
        "createdAt": 1773332877378,
        "displayName": "1password-hardened",
        "latestVersionId": "k97e90pawv3dp0j8657edz0dtn82sa30",
        "ownerUserId": "kn706xw9bamamdar1vywjx42ad81sc6v",
        "slug": "1password-hardened",
        "stats": {
            "comments": 1,
            "downloads": 124,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading\/injecting\/...",
        "tags": {
            "latest": "k97e90pawv3dp0j8657edz0dtn82sa30"
        },
        "updatedAt": 1773333416776
    }
}