SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsbyted-security-skillsscanner

byted-security-skillsscanner

Security & auditing

View repository

Updated 10-15 17:30

About this skill

Volcengine Skills Scanner

By packaging the skill directory and uploading it to the Volcengine security scanning service for scanning, audit whether other skills in the workspace have potential security risks.

When to Use

  • Audit: Regularly scan all skills to ensure compliance with security policies.
  • Development: Check your own skills during development.
  • Requirements: You must ensure that the target skill contains the SKILL.md file, because it is the main input for scanning.

Usage

Use the scripts/scan.py script to perform the scan.You must use an absolute path, do not use ~, because the running directory is not the skill directory.

The script automatically packages the directory (if a directory is provided) and uploads it, and always outputs a JSON array containing the scan results. Parse this JSON and present the results to the user in an easy-to-read format (Chinese) (risk level, detailed information, recommendations).

Scan skill (directory or archive)

The script reads configuration through environment variables (recommended)

python3 ~/.openclaw/workspace/skills/byted-security-skillsscanner/scripts/scan.py --name "bad_skills1" --path "/root/.openclaw/workspace/skills/bad_skills1"

Important：

  • The script path must be anabsolute path
  • The target path must also be anabsolute path
  • Make sure the necessary environment variables are set (VOLCENGINE_ACCESS_KEY、VOLCENGINE_SECRET_KEY、VOLCENGINE_REGION）

Report Format

When presenting the results to the user,you mustuse the following format (Chinese):

🛡️ Security Scan Report: [SkillName]

Scan time: [Convert the ScanEndTime timestamp to a readable date format] Overall status: [✅ Passed / ❌ Risks found]

Risk level Rule name Risk details
[High/Medium/Low] [RuleName] [RiskDetail]

List of discovered risks: (Only list High and Medium level risks)

  1. [RuleName] (ID: [RuleID])
    • Level: [RiskLevel]
    • File: [FileName]
    • Details: [RiskDetail]
    • Recommendation: Please check the code in the above files and remove suspicious network requests or sensitive operations.

Environment Variable Configuration

  1. Obtain Volcengine access credentials: refer to the User Guide to obtain AK/SK

  2. Configure the following environment variables:

export VOLC_ACCESS_KEY="your-access-key"
export VOLC_SECRET_KEY="your-secret-key"
export VOLC_REGION="cn-north-1"  # 可选，默认 cn-north-1