name: security description: Enterprise-grade security framework for LobsterAI with audit logging, RBAC, input validation, output sanitization, code scanning, and dependency vulnerability detection. version: 1.0.3 author: LobsterAI Security Team license: Proprietary priority: 100 tags: - security - audit - rbac - compliance - validation - scanning environment: - name: LOBSTERAI_HOME description: Base directory for LobsterAI data and logs required: false default: ${APPDATA}/LobsterAI (Windows) or ${HOME}/.config/LobsterAI (Linux/macOS) - name: LOBSTERAI_AUDIT_SECRET description: HMAC secret for audit log signature required: false - name: LOBSTERAI_USER_ID description: Current user identifier for audit trails required: false default: anonymous - name: SKILLS_ROOT description: Path to the SKILLs root directory required: false

Security

Comprehensive security framework for LobsterAI providing audit logging, role-based access control (RBAC), input validation, output sanitization, code scanning, and dependency vulnerability detection.

Core Features

Audit Logger

• Records all skill executions with timestamps, user context, and input/output
• JSON-structured logs for easy analysis
• Automatic log rotation (90 days retention)
• Encrypted storage support

Authorizer (RBAC)

• Role-based access control configuration
• Fine-grained permission management
• JSON-based role definitions
• Session validation

Input Validator

• Path traversal prevention
• Dangerous command detection (rm, del, eval, etc.)
• Cron expression validation
• Working directory restrictions

Output Sanitizer

• Automatic redaction of sensitive data (passwords, API keys, tokens)
• Error message sanitization
• Safe error formatting for user display

Code Scanner

• Static code analysis for common vulnerabilities
• Pattern-based malicious code detection

  本技能來自小蔥技能站7w4.net。

• Configurable scan rules

Dependency Scanner

• NPM vulnerability scanning (npm audit)
• Python package vulnerability detection (pip-audit)
• Automated dependency checking

Usage

All security features are available for import by other skills:

from security.audit_logger import audit_log_skill_start, audit_log_skill_end
from security.authorizer import Authorizer
from security.input_validator import InputValidator, ValidationError
from security.output_sanitizer import sanitize_text, create_safe_error
from security.code_scanner import CodeScanner
from security.dependency_scanner import DependencyScanner

Configuration

Copy rbac_config.example.json to rbac_config.json and customize roles and permissions.

Scan Scope

The code scanner and dependency scanner are designed to scan all skills in the SKILLs directory when invoked explicitly (e.g., python -m security.code_scanner --skill all). This allows comprehensive security assessment across your entire LobsterAI installation.

Privacy Note: Scanning all skills grants this module read access to all skill code and dependencies. This is intentional for a security audit tool, but users should be aware of the broad read scope. Ensure you trust the skill source before enabling full-system scanning.

To limit scanning to specific skills, invoke with explicit skill IDs:

python -m security.code_scanner --skill web-search --skill scheduled-task

Environment Variables

This skill requires the following environment variables to function correctly:

Note: Ensure LOBSTERAI_HOME/logs/security/ exists and is writable.

Deployment

See DEPLOYMENT.md for detailed deployment instructions, security hardening checklist, and incident response procedures.

Testing

Run python tests.py to execute the test suite.

Integration

This module integrates seamlessly with LobsterAI's skill execution pipeline, providing: - Pre-execution validation - Runtime monitoring - Post-execution sanitization - Comprehensive audit trails

Security Maturity

⭐⭐⭐☆☆ (3/10) - Active development

We are continuously improving our security posture. See SECURITY.md for the complete security architecture and best practices.

這個安全框架功能很全面，能審計日誌、檢查許可權、驗證輸入、掃描程式碼漏洞，對普通使用者來說開箱即用、無需安裝額外依賴。文件寫得很詳細，中文支援友好。但版本管理有點混亂，不同檔案顯示的版本號都不一樣，偶爾會有程式碼重複的小問題，掃描漏洞的能力在沒網路時會很弱。總體質量還不錯，適合對安全性有較高要求的場景使用。