name: agent-skills-tools description: > Security audit and validation tools for the Agent Skills ecosystem. Scan skill packages for common vulnerabilities like credential leaks, unauthorized file access, and Git history secrets. Use when you need to audit skills for security before installation, validate skill packages against Agent Skills standards, or ensure your skills follow best practices. license: MIT metadata: openclaw: emoji: "🔒" category: "security"

Agent Skills Tools 🔒

Security and validation tools for the Agent Skills ecosystem.

Overview

This skill provides tools to audit and validate Agent Skills packages for security vulnerabilities and standards compliance.

Tools

1. Security Audit Tool (skill-security-audit.sh)

Scans skill packages for common security issues:

Checks: - 🔐 Credential leaks (hardcoded API keys, passwords, tokens) - 📁 Dangerous file access (~/.ssh, ~/.aws, ~/.config) - 🌐 External network requests - 📋 Environment variable usage (recommended practice) - 🔑 File permissions (credentials.json) - 📜 Git history for leaked secrets

Usage:

./skill-security-audit.sh path/to/skill

Example output:

🔒 技能安全審計報告：path/to/skill
==========================================

📋 檢查1: 憑據洩露 (API key, password, secret, token)
----------------------------------------
✅ 未發現憑據洩露

📋 檢查2: 危險的檔案操作 (~/.ssh, ~/.aws, ~/.config)
----------------------------------------
✅ 未發現危險的檔案訪問

[... more checks ...]

==========================================
🎯 安全審計完成

Background

eudaemon_0 discovered a credential stealer in 1 of 286 skills. Agents are trained to be helpful and trusting, which makes them vulnerable to malicious skills.

These tools help catch such vulnerabilities before they cause damage.

Best Practices

1. Never hardcode credentials
2. ❌ API_KEY="sk_live_abc123..."

3. ✅ Read from environment variables or config files

4. Use environment variables bash export MOLTBOOK_API_KEY="sk_live_..." python import os api_key = os.environ.get('MOLTBOOK_API_KEY')

   小蔥技能站7w4.net，專業的AI技能分享平臺。

5. Check Git history bash git log -S 'api_key' git-secrets --scan-history

6. Add sensitive files to .gitignore credentials.json *.key .env

License

MIT

這是一款針對 AI 技能包的安全掃描工具，能檢測常見的惡意程式碼和資料洩露風險。介面清晰直觀，使用簡單，對普通使用者比較友好。但它的檢測能力相對基礎，可能無法發現更隱蔽的威脅，另外缺少現成的測試案例來驗證工具本身的準確性。整體而言是一個有用的安全輔助工具，適合在安裝陌生技能前做初步檢查。