@pwddd/skills-scanner 1.0.0-beta.19 → 1.0.0-beta.21

package/README.md

@@ -33,7 +33,6 @@ openclaw plugins install @pwddd/skills-scanner
         "enabled": true,
         "config": {
           "apiUrl": "https://110.vemic.com/skills-scanner",
-          "scanDirs": ["~/.openclaw/skills", "~/.openclaw/workspace/skills"],
           "behavioral": false,
           "useLLM": false,
           "policy": "balanced",
@@ -49,7 +48,6 @@ openclaw plugins install @pwddd/skills-scanner
 ### 配置说明
 
 - `apiUrl`: 扫描 API 服务地址
-- `scanDirs`: Skills 目录列表（用于批量扫描）
 - `behavioral`: 是否启用行为分析（深度扫描，较慢）
 - `useLLM`: 是否使用 LLM 进行语义分析
 - `policy`: 扫描策略

package/index.ts

@@ -6,15 +6,12 @@
 
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import { join } from "node:path";
-import os from "node:os";
-import { existsSync } from "node:fs";
 import type { ScannerConfig } from "./src/types.js";
 import { skillsScannerConfigSchema, generateConfigGuide } from "./src/config.js";
 import {
   loadState,
   saveState,
   expandPath,
-  defaultScanDirs,
   isFirstRun,
   markConfigReviewed,
   getStateDir,
@@ -53,14 +50,9 @@ export default definePluginEntry({
   }
 
   const apiUrl = cfg.apiUrl ?? "https://110.vemic.com/skills-scanner";
-  const scanDirs =
-    (cfg.scanDirs?.map(expandPath) ?? []).filter(existsSync).length > 0
-      ? cfg.scanDirs!.map(expandPath)
-      : defaultScanDirs();
   const behavioral = cfg.behavioral ?? false;
   const useLLM = cfg.useLLM ?? false;
   const policy = cfg.policy ?? "balanced";
-  const preInstallScan = cfg.preInstallScan ?? "off";
   const onUnsafe = cfg.onUnsafe ?? "warn";
   const injectSecurityGuidance = cfg.injectSecurityGuidance ?? true;
   const enableBeforeInstallHook = cfg.enableBeforeInstallHook ?? true;
@@ -68,8 +60,6 @@ export default definePluginEntry({
   api.logger.info("[skills-scanner] ═══════════════════════════════════════");
   api.logger.info("[skills-scanner] Plugin loading...");
   api.logger.info(`[skills-scanner] API URL: ${apiUrl}`);
-  api.logger.info(`[skills-scanner] Scan directories: ${scanDirs.join(", ")}`);
-  api.logger.info(`[skills-scanner] Directory monitoring: ❌ DISABLED`);
   api.logger.info(`[skills-scanner] Before-install hook: ${enableBeforeInstallHook ? "✅ ENABLED" : "❌ DISABLED"}`);
 
   if (isDebugMode()) {
@@ -177,11 +167,9 @@ export default definePluginEntry({
     const configGuide = generateConfigGuide(
       cfg,
       apiUrl,
-      scanDirs,
       behavioral,
       useLLM,
       policy,
-      preInstallScan,
       onUnsafe
     );
     console.log(configGuide);
@@ -260,14 +248,12 @@ export default definePluginEntry({
   const handlers = createCommandHandlers(
     cfg,
     apiUrl,
-    scanDirs,
     behavioral,
     useLLM,
     policy,
-    preInstallScan,
     onUnsafe,
     api.logger,
-    api.config  // 传递 api.config
+    api.config
   );
 
   // Chat command: /skills-scanner

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "skills-scanner",
   "name": "Skills Scanner",
   "description": "Security scanner for OpenClaw Skills to detect potential threats",
-  "version": "1.0.0-beta.19",
+  "version": "1.0.0-beta.21",
   "author": "pwddd",
   "skills": ["./skills"],
   "uiHints": {
@@ -27,10 +27,6 @@
       "label": "扫描策略",
       "help": "strict=严格 / balanced=平衡（推荐）/ permissive=宽松"
     },
-    "preInstallScan": {
-      "label": "安装前扫描",
-      "help": "监听新 Skill 并自动扫描"
-    },
     "onUnsafe": {
       "label": "不安全处理",
       "help": "warn=仅警告（推荐）/ quarantine=隔离 / delete=删除"
@@ -85,12 +81,6 @@
         "description": "Scanning policy: strict (more false positives) / balanced (recommended) / permissive (may miss threats)",
         "default": "balanced"
       },
-      "preInstallScan": {
-        "type": "string",
-        "enum": ["on", "off"],
-        "description": "Enable pre-installation scanning (monitors directories for new Skills)",
-        "default": "on"
-      },
       "onUnsafe": {
         "type": "string",
         "enum": ["quarantine", "delete", "warn"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pwddd/skills-scanner",
-  "version": "1.0.0-beta.19",
+  "version": "1.0.0-beta.21",
   "description": "OpenClaw Skills security scanner plugin - detect malicious code, data exfiltration, and prompt injection",
   "type": "module",
   "main": "./index.ts",

package/skills/skills-scanner/SKILL.md

@@ -23,27 +23,6 @@ OpenClaw Skills 安全扫描工具，检测恶意代码、数据窃取、提示
 
 **🔒 安全扫描是强制性的，不可跳过。在向用户展示扫描结果前，请务必：**
 
-### 🔄 插件版本检查 - 每次运行前必须执行
-
-**在执行任何扫描操作前，必须先检查并更新 skills-scanner 插件到最新版本。**
-
-**更新命令**：
-```bash
-openclaw plugins update skills-scanner
-```
-
-**执行时机**：
-- 每次用户请求扫描 Skill 时
-- 每次用户请求安装 Skill 时
-- 每次会话开始时（如果涉及 Skill 操作）
-
-**为什么要每次检查更新？**
-- 安全威胁不断演变，扫描规则需要持续更新
-- 新版本可能包含关键的安全修复
-- 确保使用最新的威胁检测能力
-
----
-
 ### 🎯 命令识别 - 自动触发安全扫描
 
 **当用户输入以下任何命令或类似表达时，你必须先扫描再执行：**
@@ -67,10 +46,6 @@ openclaw plugins update skills-scanner
        [执行：openclaw clawhub search caldav-calendar]
        找到：https://clawhub.ai/Asleep123/caldav-calendar
 
-       现在更新扫描插件...
-       [执行：openclaw plugins update skills-scanner]
-       ✅ 插件已更新
-
        扫描安全性...
        [执行扫描]
        ✅ 扫描通过，开始安装
@@ -80,11 +55,7 @@ openclaw plugins update skills-scanner
 
    ```
    用户：openclaw clawhub install https://clawhub.ai/Asleep123/caldav-calendar
-   AI: 我看到你想安装 caldav-calendar，让我先更新扫描插件...
-       [执行：openclaw plugins update skills-scanner]
-       ✅ 插件已更新
-
-       扫描安全性...
+   AI: 我看到你想安装 caldav-calendar，让我先扫描安全性...
        [执行扫描]
        ✅ 扫描通过，开始安装
    ```
@@ -92,9 +63,8 @@ openclaw plugins update skills-scanner
 3. **正确的处理流程**：
    ```
    步骤 1: 如果只有名称 → 使用 clawhub search 查找完整 URL
-   步骤 2: 更新 skills-scanner 插件
-   步骤 3: 使用完整 URL 进行安全扫描
-   步骤 4: 扫描通过后执行安装命令
+   步骤 2: 使用完整 URL 进行安全扫描
+   步骤 3: 扫描通过后执行安装命令
    ```
 
 ---
@@ -240,34 +210,28 @@ openclaw plugins update skills-scanner
 **在处理任何 Skill 相关操作时，请先问自己这些问题：**
 
 1. ✅ 如果是 ClawHub 安装且只有名称，我是否已经搜索了完整 URL？
-2. ✅ 我是否已经更新了 skills-scanner 插件到最新版本？
-3. ✅ 我是否已经扫描了这个 Skill？
-4. ✅ 扫描是否通过？
-5. ✅ 只有所有适用步骤都是 YES，才能继续操作
+2. ✅ 我是否已经扫描了这个 Skill？
+3. ✅ 扫描是否通过？
+4. ✅ 只有所有适用步骤都是 YES，才能继续操作
 
-**如果你忘记搜索、更新或扫描就执行了操作，你就让用户的系统暴露在风险之中。**
+**如果你忘记搜索或扫描就执行了操作，你就让用户的系统暴露在风险之中。**
 
 ### 🚨 强制性规则（永远不要忘记）
 
-1. **任何 Skill 操作前 → 先更新插件**
-   - 执行 `openclaw plugins update skills-scanner`
-   - 确保使用最新的威胁检测规则
-
-2. **看到安装命令 → 搜索（如需要）→ 更新插件 → 立即扫描**
-   - `openclaw clawhub install xxx` → 先搜索，再更新插件，再扫描
+1. **看到安装命令 → 搜索（如需要）→ 立即扫描**
+   - `openclaw clawhub install xxx` → 先搜索，再扫描
    - 任何包含 "install"、"add"、"download" + "skill" 的命令 → 完整流程
 
-3. **看到 Skill 路径 → 更新插件 → 立即扫描**
-   - 用户提到 `~/.openclaw/skills/xxx` → 先更新插件，再扫描
-   - 用户说 "我下载了一个 skill" → 先更新插件，再扫描
+2. **看到 Skill 路径 → 立即扫描**
+   - 用户提到 `~/.openclaw/skills/xxx` → 立即扫描
+   - 用户说 "我下载了一个 skill" → 立即扫描
 
-4. **看到 ClawHub URL → 更新插件 → 立即扫描**
-   - `https://clawhub.ai/username/project` → 先更新插件，再扫描
+3. **看到 ClawHub URL → 立即扫描**
+   - `https://clawhub.ai/username/project` → 立即扫描
 
 ### ❌ 绝对禁止的行为
 
-- ❌ 不更新插件就直接扫描
-- ❌ 直接执行安装命令而不先搜索、更新和扫描
+- ❌ 直接执行安装命令而不先搜索和扫描
 - ❌ 因为 "用户着急" 或 "看起来安全" 就跳过任何步骤
 
 ---

package/src/commands.ts

@@ -12,14 +12,12 @@ import type { ScannerConfig, CommandResponse, PluginLogger } from "./types.js";
 export function createCommandHandlers(
   cfg: ScannerConfig,
   apiUrl: string,
-  scanDirs: string[],
   behavioral: boolean,
   useLLM: boolean,
   policy: string,
-  preInstallScan: string,
   onUnsafe: string,
   logger: PluginLogger,
-  apiConfig?: any  // 添加 api.config 参数
+  apiConfig?: any
 ) {
   async function handleScanCommand(args: string): Promise<CommandResponse> {
     if (!args) {
@@ -116,12 +114,10 @@ export function createCommandHandlers(
     const lines = [
       "✅ *Skills Scanner 状态*",
       `API 地址：${apiUrl}`,
-      `安装前扫描：${preInstallScan === "on" ? `✅ 监听中 (${onUnsafe})` : "⏭️ 已禁用"}`,
       `扫描策略：${policy}`,
       `LLM 分析：${useLLM ? "✅ 启用" : "❌ 禁用"}`,
       `行为分析：${behavioral ? "✅ 启用" : "❌ 禁用"}`,
       `上次扫描：${state.lastScanAt ? new Date(state.lastScanAt).toLocaleString("zh-CN") : "从未"}`,
-      `扫描目录:\n${scanDirs.map((d) => `  📁 ${d}`).join("\n")}`,
     ];
 
     // API health check
@@ -163,11 +159,9 @@ export function createCommandHandlers(
       const configGuide = generateConfigGuide(
         cfg,
         apiUrl,
-        scanDirs,
         behavioral,
         useLLM,
         policy,
-        preInstallScan,
         onUnsafe
       );
       return { text: "```\n" + configGuide + "\n```" };

package/src/config-validator.ts

@@ -31,15 +31,6 @@ export function validateConfig(
     }
   }
 
-  // Validate scan directories
-  if (cfg.scanDirs && cfg.scanDirs.length > 0) {
-    for (const dir of cfg.scanDirs) {
-      if (!existsSync(dir)) {
-        warnings.push(`Scan directory does not exist: ${dir}`);
-      }
-    }
-  }
-
   // Validate policy
   if (cfg.policy && !["strict", "balanced", "permissive"].includes(cfg.policy)) {
     errors.push(
@@ -47,13 +38,6 @@ export function validateConfig(
     );
   }
 
-  // Validate preInstallScan
-  if (cfg.preInstallScan && !["on", "off"].includes(cfg.preInstallScan)) {
-    errors.push(
-      `Invalid preInstallScan: "${cfg.preInstallScan}". Must be "on" or "off"`
-    );
-  }
-
   // Validate onUnsafe
   if (cfg.onUnsafe && !["warn", "delete", "quarantine"].includes(cfg.onUnsafe)) {
     errors.push(

package/src/config.ts

@@ -24,19 +24,6 @@ export const skillsScannerConfigSchema: OpenClawPluginConfigSchema = {
         };
       }
 
-      // 验证 preInstallScan
-      if (config.preInstallScan && !["on", "off"].includes(config.preInstallScan)) {
-        return {
-          success: false,
-          error: {
-            issues: [{
-              path: ["preInstallScan"],
-              message: "preInstallScan 必须是 on 或 off"
-            }]
-          }
-        };
-      }
-
       // 验证 onUnsafe
       if (config.onUnsafe && !["quarantine", "delete", "warn"].includes(config.onUnsafe)) {
         return {
@@ -72,12 +59,6 @@ export const skillsScannerConfigSchema: OpenClawPluginConfigSchema = {
       type: "string",
       format: "uri",
     },
-    scanDirs: {
-      label: "扫描目录",
-      help: "要监控的 Skills 目录列表，支持 ~ 路径。默认监控 ~/.openclaw/skills 和 ~/.openclaw/workspace/skills",
-      type: "array",
-      items: { type: "string" },
-    },
     behavioral: {
       label: "行为分析",
       help: "启用深度行为分析（较慢但更准确）。检测运行时行为模式，如网络请求、文件操作等",
@@ -97,13 +78,6 @@ export const skillsScannerConfigSchema: OpenClawPluginConfigSchema = {
       enum: ["strict", "balanced", "permissive"],
       default: "balanced",
     },
-    preInstallScan: {
-      label: "安装前扫描",
-      help: "监听新 Skill 并自动扫描。⚠️ 此功能已禁用，请使用手动扫描",
-      type: "string",
-      enum: ["on", "off"],
-      default: "off",
-    },
     onUnsafe: {
       label: "不安全处理",
       help: "warn=仅警告（推荐，不影响使用）/ quarantine=隔离到隔离区 / delete=直接删除（危险）",
@@ -147,11 +121,9 @@ export const skillsScannerConfigSchema: OpenClawPluginConfigSchema = {
 export function generateConfigGuide(
   cfg: ScannerConfig,
   apiUrl: string,
-  scanDirs: string[],
   behavioral: boolean,
   useLLM: boolean,
   policy: string,
-  preInstallScan: string,
   onUnsafe: string
 ): string {
   return [
@@ -164,7 +136,6 @@ export function generateConfigGuide(
     "",
     "📋 当前配置：",
     `  • API 服务地址：${apiUrl}`,
-    `  • 扫描目录：${scanDirs.length} 个（自动检测）`,
     `  • 行为分析：${behavioral ? "✅ 启用" : "❌ 禁用"}`,
     `  • LLM 分析：${useLLM ? "✅ 启用" : "❌ 禁用"}`,
     `  • 扫描策略：${policy}`,
@@ -184,7 +155,6 @@ export function generateConfigGuide(
     '        "enabled": true,',
     '        "config": {',
     '          "apiUrl": "https://110.vemic.com/skills-scanner",',
-    '          "scanDirs": ["~/.openclaw/skills"],',
     '          "behavioral": false,',
     '          "useLLM": false,',
     '          "policy": "balanced",',
@@ -199,11 +169,10 @@ export function generateConfigGuide(
     "💡 配置说明：",
     "",
     "1. apiUrl        默认 https://110.vemic.com/skills-scanner",
-    "2. scanDirs      可添加多个目录（默认自动检测 ~/.openclaw/skills）",
-    "3. behavioral    false=快速扫描（推荐），true=深度分析",
-    "4. useLLM        false=不使用 LLM（推荐），true=语义分析",
-    "5. policy        strict / balanced（推荐）/ permissive",
-    "6. onUnsafe      warn=仅警告（推荐），quarantine=隔离，delete=删除",
+    "2. behavioral    false=快速扫描（推荐），true=深度分析",
+    "3. useLLM        false=不使用 LLM（推荐），true=语义分析",
+    "4. policy        strict / balanced（推荐）/ permissive",
+    "5. onUnsafe      warn=仅警告（推荐），quarantine=隔离，delete=删除",
     "",
     "⚠️ 注意：目录监控功能已禁用，请使用以下命令手动扫描：",
     "  /skills-scanner scan <路径>",

package/src/prompt-guidance.ts

@@ -23,24 +23,18 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "",
   "### Required Workflow (MUST FOLLOW IN ORDER)",
   "",
-  "**STEP 1: Update Plugin** (ALWAYS, every single time)",
-  "```bash",
-  "openclaw plugins update skills-scanner",
-  "```",
-  "Why: Threat detection rules evolve; latest version has critical security fixes.",
-  "",
-  "**STEP 2: Search** (if user provided only skill name, no URL)",
+  "**STEP 1: Search** (if user provided only skill name, no URL)",
   "```bash",
   "openclaw clawhub search <skill-name>",
   "```",
   "Extract the full ClawHub URL from search results.",
   "",
-  "**STEP 3: Security Scan**",
+  "**STEP 2: Security Scan**",
   "- Local: `/skills-scanner scan <path>`",
   "- ClawHub: `/skills-scanner scan clawhub <URL>`",
   "- Batch: `/skills-scanner scan <directory> --recursive`",
   "",
-  "**STEP 4: Proceed Only If Safe**",
+  "**STEP 3: Proceed Only If Safe**",
   "Continue ONLY when scan shows ✅ passed.",
   "",
   "### Examples",
@@ -48,32 +42,28 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "**Example 1: Install by name**",
   "```",
   "User: Install caldav-calendar skill",
-  "AI: 1. [Execute: openclaw plugins update skills-scanner]",
-  "    2. [Execute: openclaw clawhub search caldav-calendar]",
+  "AI: 1. [Execute: openclaw clawhub search caldav-calendar]",
   "       → Found: https://clawhub.ai/Asleep123/caldav-calendar",
-  "    3. [Execute: /skills-scanner scan clawhub https://clawhub.ai/Asleep123/caldav-calendar]",
+  "    2. [Execute: /skills-scanner scan clawhub https://clawhub.ai/Asleep123/caldav-calendar]",
   "       → ✅ Scan passed",
-  "    4. [Execute: openclaw clawhub install caldav-calendar]",
+  "    3. [Execute: openclaw clawhub install caldav-calendar]",
   "```",
   "",
   "**Example 2: Direct URL**",
   "```",
   "User: openclaw clawhub install https://clawhub.ai/steipete/nano-pdf",
-  "AI: 1. [Execute: openclaw plugins update skills-scanner]",
-  "    2. [Execute: /skills-scanner scan clawhub https://clawhub.ai/steipete/nano-pdf]",
+  "AI: 1. [Execute: /skills-scanner scan clawhub https://clawhub.ai/steipete/nano-pdf]",
   "       → ✅ Scan passed",
-  "    3. [Execute: openclaw clawhub install https://clawhub.ai/steipete/nano-pdf]",
+  "    2. [Execute: openclaw clawhub install https://clawhub.ai/steipete/nano-pdf]",
   "```",
   "",
   "### ❌ Prohibited (NEVER DO)",
   "",
-  "- Execute install without updating plugin first",
   "- Skip scan due to \"trusted source\" or user urgency",
   "- Proceed when scan fails—warn user about risks instead",
   "",
   "### ✅ Pre-flight Checklist",
   "",
-  "- [ ] Plugin updated?",
   "- [ ] Full URL obtained (if only name given)?",
   "- [ ] Scan executed?",
   "- [ ] Scan passed?",

package/src/state.ts

@@ -93,12 +93,10 @@ export function isFirstRun(cfg: ScannerConfig, runtime?: PluginRuntime): boolean
 
   const isDefaultConfig =
     !cfg.apiUrl &&
-    (!cfg.scanDirs || cfg.scanDirs.length === 0) &&
     cfg.behavioral !== true &&
     cfg.useLLM !== true &&
     cfg.policy !== "strict" &&
     cfg.policy !== "permissive" &&
-    cfg.preInstallScan !== "off" &&
     cfg.onUnsafe !== "delete" &&
     cfg.onUnsafe !== "warn";
 
@@ -114,21 +112,6 @@ export function expandPath(p: string): string {
   return p.replace(/^~/, os.homedir());
 }
 
-export function defaultScanDirs(): string[] {
-  const dirs = [
-    join(os.homedir(), ".openclaw", "skills"),
-    join(os.homedir(), ".openclaw", "workspace", "skills"),
-  ];
-
-  for (const dir of dirs) {
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
-    }
-  }
-
-  return dirs;
-}
-
 // Export for backward compatibility
 export { LEGACY_STATE_DIR as STATE_DIR };
 export function STATE_FILE(runtime?: PluginRuntime): string {

package/src/types.ts

@@ -4,11 +4,9 @@
 
 export interface ScannerConfig {
   apiUrl?: string;
-  scanDirs?: string[];
   behavioral?: boolean;
   useLLM?: boolean;
   policy?: "strict" | "balanced" | "permissive";
-  preInstallScan?: "on" | "off";
   onUnsafe?: "quarantine" | "delete" | "warn";
   injectSecurityGuidance?: boolean;
   enableBeforeInstallHook?: boolean;