47/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： clean

OpenClaw： suspicious

The skill's instructions match a hybrid local/cloud security scanner, but there are mismatches and privacy/network concerns (uploading extracted code snippets to an external endpoint and the SKILL.md ...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： clean

No suspicious patterns detected.

README 未提供

{
    "latestVersion": {
        "_creationTime": 1773304019414,
        "_id": "k97ewr7ns3x6ejvxa12sea6aqd82rwb2",
        "changelog": "my-test-skill v0.0.1\n\n- Initial release of an intelligent code security scanner with hybrid local-cloud detection.\n- Performs package fingerprinting, static behavioral analysis, and cloud-based threat intelligence lookups (enabled by default, configurable).\n- Provides a quantified safety score and severity tags based on code behaviors and source trust.\n- Defaults to strong privacy safeguards: only non-sensitive metadata is uploaded for cloud analysis.\n- Supports trusted registry allowlisting and customizable environment settings.",
        "changelogSource": "user",
        "createdAt": 1773304019414,
        "parsed": {
            "clawdis": {
                "emoji": "⚡",
                "envVars": [
                    {
                        "description": "Enable or disable cloud threat intelligence. Default: true",
                        "name": "YIDUN_SKILL_SEC_CLOUD",
                        "required": false
                    },
                    {
                        "description": "Comma-separated list of additional trusted registry hostnames",
                        "name": "YIDUN_SKILL_SEC_TRUSTED_REGISTRIES",
                        "required": false
                    }
                ],
                "os": [
                    "linux",
                    "darwin",
                    "win32"
                ],
                "requires": {
                    "bins": [
                        "curl",
                        "jq",
                        "openssl"
                    ]
                }
            }
        },
        "version": "0.0.1"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "jinxiaotian1",
        "handle": "jinxiaotian1",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/140487063?v=4",
        "kind": "user",
        "linkedUserId": "kn76r21f9cf2b5re6zh5r104y982qar7"
    },
    "ownerHandle": "jinxiaotian1",
    "skill": {
        "_creationTime": 1773304019414,
        "_id": "kd76rswvbhra256hdwq8b6td7d82rtpz",
        "badges": [],
        "createdAt": 1773304019414,
        "displayName": "my-test-skill",
        "latestVersionId": "k97ewr7ns3x6ejvxa12sea6aqd82rwb2",
        "ownerUserId": "kn76r21f9cf2b5re6zh5r104y982qar7",
        "slug": "my-test-skill",
        "stats": {
            "comments": 0,
            "downloads": 133,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "Intelligent code security scanner with hybrid local-cloud detection. Fingerprints packages, runs static behavioral analysis, and consults cloud threat intell...",
        "tags": {
            "latest": "k97ewr7ns3x6ejvxa12sea6aqd82rwb2"
        },
        "updatedAt": 1774332408509
    }
}