SKILLEMALL.ai
GitHub ↗ RU Sign in

FD skill-analysis

装 Skill 前，先过一遍安检 —— 纯本地 · 零外联 · 零第三方依赖，代码不出你的机器。①【一句话结论】BLOCK / NEED_REVIEW / PASS 准入判定 + 0-100 风险评分 + A-F 等级与发布建议。②【全自动守护】会话启动自动扫描、新装 Skill 静默体检。③【深度对抗】多层混淆解码、污点数据流、Unicode 走私指令解码、反序列化 RCE、沙箱动态取证。④【情报驱动】勒索病毒、提示注入、MCP 工具投毒、供应链投毒、金融欺诈诱导、身份自改写持久化。⑤【工程化】跨平台批量扫描、CI 门禁、SARIF/SBOM/JSON 导出。⑥【可自证可信】无自动更新、发布者签名锚 + SHA-256 + 一键签名核验 + 独立复验。\n\nEN: Run a security check before installing any Skill -- 100% local, zero network calls, zero third-party dependencies; your code never leaves your machine. (1) One-shot verdict: BLOCK / NEED_REVIEW / PASS with a 0-100 risk score, A-F grading and publishing advice. (2) Always-on guard: auto-scan at session start, silent health checks for newly installed Skills. (3) Deep adversarial detection: multi-layer de-obfuscation, taint data-flow, Unicode smuggled-instruction decoding, deserialization RCE, sandboxed dynamic forensics. (4) Intelligence-driven rules: ransomware, prompt injection, MCP tool poisoning, supply-chain poisoning, financial-fraud inducement, identity self-rewrite persistence. (5) Engineering: cross-platform batch scanning, CI gate, SARIF/SBOM/JSON export. (6) Self-verifiable trust: no auto-update, publisher signature anchor + SHA-256 + one-command signature verification + independent re-validation.

Not recommendedcritical or high security findings · low grade F
ClawHub Agent Skills author: JiXiang-cc v3.3.8 MIT-0 57 files · 8 scripts body ≈ 1 837 tokens Open the sourceclawhub.ai↗ analyzed 14 d ago

装 Skill 前，先过一遍安检 —— 纯本地 · 零外联 · 零第三方依赖，代码不出你的机器。①【一句话结论】BLOCK / NEEDREVIEW / PASS 准入判定 + 0-100 风险评分 + A-F 等级与发布建议。②【全自动守护】会话启动自动扫描、新装 Skill…

As a process D 41/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions

AnalyzerAI and agentstype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
F
20/100
safety, quality, tests
Safety 60%
6
Quality 40%
41
Run on models
none yet
Process rating
D
41/100
Unfinished process
Result and completion w 14
0
Inputs and preconditions w 11
0
Failures and branches w 10
0
the three weakest of ten parameters · all ten

What is at stake

The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.

Dangerous commands
If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

How to improve

  1. Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
  2. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
  3. Shorten the description to 1024 characters.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 33

  • high Dangerous commands cmd-encoded-exec CHANGELOG.md:233
    Executes a base64/encoded payload (documentation of a security skill)
    - 修复：分两级检测 —— ① 高危组合（curl|sh / base64 -d / powershell -enc / 破坏性命令 / 执行原语直连外部）新增行独立命中即报；② 通用执行原语（`eval`/`exec`/`os.system`/`subprocess`）须与网络/解码/外传信号**同行**才报。仅扫描新增行（`+` 前缀），排除已删除行的历史修复代码。
    security skill
Medium and low: 32
  • medium Dangerous commands cmd-pipe-to-shell CHANGELOG.md:37
    Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
    - 实测确认已覆盖无需新增：.claude/settings.json hooks（HookPry）、Prerequisites curl|bash（v3.3.5 降级）、
    security skill
  • medium Dangerous commands cmd-pipe-to-shell CHANGELOG.md:233
    Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
    - 修复：分两级检测 —— ① 高危组合（curl|sh / base64 -d / powershell -enc / 破坏性命令 / 执行原语直连外部）新增行独立命中即报；② 通用执行原语（`eval`/`exec`/`os.system`/`subprocess`）须与网络/解码/外传信号**同行**才报。仅扫描新增行（`+` 前缀），排除已删除行的历史修复代码。
    security skill
  • medium Dangerous commands cmd-pipe-to-shell CHANGELOG.md:254
    Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
    - `scan_git_history(root, files_text)`：`.git` 走 `git log -p` 或 `*.patch/*.diff` 块扫描危险原语（eval/exec/os.system/subprocess/curl|sh/wget|sh/base64 -d/powershell -enc/rm -rf /）→ P1；仅纯本地、无外联。
    security skill
  • medium Dangerous commands cmd-pipe-to-shell CHANGELOG.md:319
    Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
    - `IMPERATIVE_EXEC_RE`：命令式动作（执行/运行/发送/上传/删除/curl|sh/os.system…）；
    security skill
  • medium Dangerous commands cmd-pipe-to-shell references/troubleshooting.md:179
    Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation of a security skill)
    场景：SKILL.md 中嵌入了长 base64 块，解码后是 curl | bash 命令。
    security skill
  • medium Dangerous commands cmd-pipe-to-shell rules/mcp-dangers.json:15
    Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)
    "label": "MCP server 启动命令含 curl|bash 远程执行",
    code literal
  • medium Exfiltration intent-browser-credential-store rules/secret-read.json:61
    Accesses a browser credential / cookie store (detector / deny-list definition)
    "re": "Login Data(?:\\s+For\\s+Profile)?|Local State|\\bCookies\\b|Web Data|History\\.db|~\\.mozilla/firefox|key4\\.db|logins\\.json|AppData[^\\n]{0,60}(?:Chrome|Edge|Chromium)[^\\n]{0,60}(?:User Data
    detector
  • medium Dangerous commands cmd-pipe-to-shell rules/shell-danger.json:8
    Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)
    "label": "SKILL.md 内含 curl|bash 远程执行",
    code literal
  • medium Dangerous commands cmd-pipe-to-shell rules/shell-danger.json:16
    Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)
    "label": "SKILL.md 内含 wget|sh 远程执行",
    code literal
  • medium Dangerous commands cmd-pipe-to-shell rules/supply-chain-2026.json:198
    Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)
    "why": "下载二进制→chmod +x→直接执行是无沙箱执行的典型链（excel-automation/AMOS 样本形态），与纯 curl|bash 管道同样危险。",
    code literal
  • low Risky intent intent-offensive-security CHANGELOG.md:386
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    - **BUG-2（严重功能失效）**：`FS_SERVER_ABUSE_PATTERNS` 编译时漏加 `re.M`，而 git 配置规则全部以 `^` 行首锚定；无 `re.M` 时 `^` 仅匹配整串开头，多行 `.git/config` 中 `fsmonitor=` 等永远无法命中——v3.2.7 主打的 Git 配置执行检测形同虚设（仅不依赖 `^` 的通用穿越规则侥幸命中）。同类缺陷同
  • low Risky intent intent-offensive-security CHANGELOG.md:430
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
    新增勒索病毒（Ransomware）专项检测：**① 新建 `rules/ransomware.json`（15 条规则）**——覆盖勒索攻击链各阶段静态特征：勒索要求与联系话术、文件加密算法（对称与非对称加密）、删除卷影副本与破坏系统恢复、终止安全/备份/数据库服务、已知勒索家族名与加密文件后缀、SSH 端口横向扫描、进程伪装、ESXi 虚拟机加密、窃取加加密双阶段勒索（数据窃取工具外传）。依据
  • low Risky intent intent-offensive-security README.md:8
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    description: '装 Skill 前，先过一遍安检 —— 纯本地 · 零外联 · 零第三方依赖，代码不出你的机器。①【一句话结论】BLOCK / NEED_REVIEW / PASS 准入判定 + 0-100 风险评分 + A-F 等级与发布建议。②【全自动守护】会话启动自动扫描、新装 Skill 静默体检。③【深度对抗】多层混淆解码、污点数据流、Unicode 走私指令解码、反序列化
    detector
  • low Risky intent intent-offensive-security README.md:9
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    keywords: [security, audit, scan, skill, safety, vulnerability, agent, prompt-injection, malware, mcp, supply-chain, ransomware]
    detector
  • low Dangerous commands cmd-pipe-to-shell rules/agent-config-poison.json:41
    Downloads and executes remote code from an unrecognised host (pipe to shell) (detector / deny-list definition; string literal in code, not executed)
    "re": "\"(?:command|cmd|run|args|preLaunchTask|postDebugTask|options|hooks)\"\\s*:\\s*(\"|\\[)[^\\n]{0,200}?(?:curl|wget|bash|sh\\s+-c|powershell|pwsh|cmd\\.exe|node\\s+-e|python\\s+-c|\\|\\s*sh|\\|\\
    detectorcode literal
  • low Dangerous commands cmd-persistence rules/capability.json:50
    Persistence mechanism (cron / launchd / scheduled task / autorun registry) (detector / deny-list definition; string literal in code, not executed)
    "re": "@reboot|crontab|launchctl|schtasks|systemctl\\s+enable|Startup",
    detectorcode literal
  • low Dangerous commands cmd-pipe-to-shell rules/install-hooks.json:42
    Downloads and executes remote code from an unrecognised host (pipe to shell) (detector / deny-list definition; string literal in code, not executed)
    "re": "\"hooks?\"\\s*:\\s*[\\[\\{]?[^\\n]{0,160}?\"(?:command|cmd|run|exec|shellCommand)\"\\s*:\\s*\"(?!(?:\\s*(?:npx|pnpm|bunx|uvx|pipx|npm|yarn|bun)\\s+)*(?:--yes\\s+)?(?:prettier|eslint|stylelint|b
    detectorcode literal
  • low Dangerous commands cmd-cryptominer rules/malware.json:23
    Installs or runs a cryptocurrency miner on the user's machine (string literal in code, not executed; documentation of a security skill)
    "re": "stratum\\+tcp|xmrig|minerd|cpuminer|cryptonight",
    code literalsecurity skill
  • low Dangerous commands cmd-disable-security rules/ransomware.json:120
    Disables a security control (Defender, Gatekeeper, SIP, firewall, execution policy) (security demo / example; quoted — discussed, not commanded)
    "why": "检出通过 PowerShell 禁用 Windows Defender 实时防护（Set-MpPreference -DisableRealtimeMonitoring）。Akira 等勒索家族加密前会禁用端侧防护，是高置信的勒索/恶意前置动作。",
    demoquoted
  • low Dangerous commands cmd-privilege rules/risk-rules.json:85
    Privilege escalation / world-writable permissions (string literal in code, not executed)
    "label": "开放全局可写权限 (chmod 777)",
    code literal
  • low Dangerous commands cmd-persistence rules/shell-danger.json:87
    Persistence mechanism (cron / launchd / scheduled task / autorun registry) (detector / deny-list definition; string literal in code, not executed)
    "re": "@reboot|crontab\\s+-|launchctl\\s+load|schtasks\\b|systemctl\\s+enable|CurrentVersion\\\\Run",
    detectorcode literal
  • low Secrets in code secret-high-entropy-token rules/supply-chain-2026.json:36
    High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
    "AI_S…6H2（2026-09-29 编制，情报窗口 2026-03~09，40+ 来源；R01-R17 风险映射）",
    quoted
  • low Risky intent intent-offensive-security SKILL.md:8
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    description: '装 Skill 前，先过一遍安检 —— 纯本地 · 零外联 · 零第三方依赖，代码不出你的机器。①【一句话结论】BLOCK / NEED_REVIEW / PASS 准入判定 + 0-100 风险评分 + A-F 等级与发布建议。②【全自动守护】会话启动自动扫描、新装 Skill 静默体检。③【深度对抗】多层混淆解码、污点数据流、Unicode 走私指令解码、反序列化
    detector
  • low Risky intent intent-offensive-security SKILL.md:9
    Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
    keywords: [security, audit, scan, skill, safety, vulnerability, agent, prompt-injection, malware, mcp, supply-chain, ransomware]
    detector

A further 8 matches are quotations in this security skill's documentation and are not counted as findings.

Files scanned: 57. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • error description-long description is 1258 chars, limit 1024
  • warning description-no-when description does not say WHEN to use the skill (no "use when")
  • note frontmatter-key unknown frontmatter key "slug"
  • note frontmatter-key unknown frontmatter key "displayName"
  • note frontmatter-key unknown frontmatter key "keywords"
  • note frontmatter-key unknown frontmatter key "triggers"

Process rating: all ten parameters 41/100

  • 0Result and completion. Does not say what the result is
  • 0Inputs and preconditions. Does not say what the process needs to start
  • 0Failures and branches. Linear process with no failure handling
  • 0Progress reporting. Says nothing while it works
  • 20When it triggers. No condition that starts the skill
  • 30Running it twice. 2 mutating operations with no state check
  • 60Tools and files. Uses tools (bash, python) that frontmatter does not declare
  • 85Steps. 30 steps, 1 vague phrases
  • 100Consistency. Name and required fields are in place
  • 100Execution cost. Instruction body is 1837 tokens
  • low 12 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Description length 1258: 120–800 characters recommended
  • +3Output format is not stated: the model decides each time
  • -214 emoji in the instructions: noise for the model
  • -34 of 8 scripts are never mentioned in SKILL.md
  • +2Single-language instructions
  • +4Structure: 13 headings
  • +3Step-by-step instructions: 30 items
  • +4Has examples (1 code blocks)
  • +4Reference files are cited in the instructions (3 of 7)
  • +1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 41.

External checks

ClawHub: suspicious
This is a local Skill security scanner, but its batch mode can execute untrusted target code automatically despite saying dynamic execution is opt-in.
LLM: suspicious (high) · 6 Oct 2026