skillguard

TotalClaw 作者 totalclaw

在安装之前通过 SkillGuard API 审核 OpenClaw 技能的安全风险。

安装 / 下载方式

TotalClaw CLI推荐

totalclaw skills install shop:totalclaw:totalclaw~jonathanliu811026-skillguard-audit

cURL直接下载，无需登录

curl -fsSL https://skills.taituai.com/api/skills/totalclaw%3Atotalclaw~jonathanliu811026-skillguard-audit/file -o jonathanliu811026-skillguard-audit.md

## 概述（中文）

在安装之前通过 SkillGuard API 审核 OpenClaw 技能的安全风险。

## 原文

# SkillGuard

Audit any OpenClaw skill for security risks **before** you install it.

Calls the SkillGuard API (`https://api.agentsouls.io/api/audit`) and returns a verdict, risk score, and threat list.

## Usage

### Audit a skill from ClawHub by name

```bash
bash skills/skillguard/audit.sh --name <skill-slug>
```

This uses `clawhub inspect --file` to pull the skill's SKILL.md (and any scripts), then sends the code to the audit API.

### Audit a local file

```bash
bash skills/skillguard/audit.sh --code <path-to-file>
```

Reads the file and sends its contents for audit.

### Output

Returns JSON with:
- **verdict**: `SAFE` | `CAUTION` | `DANGEROUS`
- **riskScore**: 0–100
- **threats**: list of identified risks

Example:
```json
{
  "verdict": "CAUTION",
  "riskScore": 35,
  "threats": ["Executes arbitrary shell commands", "Accesses network without disclosure"]
}
```

## When to use

**Before installing any new skill**, run:

```bash
bash skills/skillguard/audit.sh --name <skill-name>
```

If verdict is `DANGEROUS`, do **not** install. If `CAUTION`, review the threats and decide with the user.