@pwddd/skills-scanner 1.0.3 → 3.0.2

package/index.ts

@@ -25,6 +25,8 @@ import { ensureCronJob } from "./src/cron.js";
 import { startWatcher } from "./src/watcher.js";
 import { createCommandHandlers } from "./src/commands.js";
 import { SKILLS_SECURITY_GUIDANCE } from "./src/prompt-guidance.js";
+import { PROMPT_INJECTION_GUARD } from "./src/prompt-injection-guard.js";
+import { HIGH_RISK_OPERATION_GUARD } from "./src/high-risk-operation-guard.js";
 
 // Constants
 const PLUGIN_ROOT = process.env.OPENCLAW_PLUGIN_ROOT || __dirname;
@@ -48,6 +50,8 @@ export default function register(api: OpenClawPluginApi) {
   const preInstallScan = cfg.preInstallScan ?? "on";
   const onUnsafe = cfg.onUnsafe ?? "quarantine";
   const injectSecurityGuidance = cfg.injectSecurityGuidance ?? true;
+  const enablePromptInjectionGuard = cfg.enablePromptInjectionGuard ?? true;
+  const enableHighRiskOperationGuard = cfg.enableHighRiskOperationGuard ?? true;
 
   api.logger.info("[skills-scanner] ═══════════════════════════════════════");
   api.logger.info("[skills-scanner] Plugin loading...");
@@ -59,10 +63,30 @@ export default function register(api: OpenClawPluginApi) {
 
   // Inject system prompt guidance (can be disabled via config)
   if (injectSecurityGuidance) {
+    // Build combined guidance
+    const guidanceParts = [SKILLS_SECURITY_GUIDANCE];
+    
+    if (enablePromptInjectionGuard) {
+      guidanceParts.push(PROMPT_INJECTION_GUARD);
+    }
+    
+    if (enableHighRiskOperationGuard) {
+      guidanceParts.push(HIGH_RISK_OPERATION_GUARD);
+    }
+    
+    const combinedGuidance = guidanceParts.join("\n\n");
+    
     api.on("before_prompt_build", async () => ({
-      prependSystemContext: SKILLS_SECURITY_GUIDANCE,
+      prependSystemContext: combinedGuidance,
     }));
+    
     api.logger.info("[skills-scanner] ✅ Security guidance injected into system prompt");
+    if (enablePromptInjectionGuard) {
+      api.logger.info("[skills-scanner]    - Prompt injection guard enabled");
+    }
+    if (enableHighRiskOperationGuard) {
+      api.logger.info("[skills-scanner]    - High-risk operation guard enabled");
+    }
   } else {
     api.logger.info("[skills-scanner] ⏭️  Security guidance injection disabled");
   }

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "skills-scanner",
   "name": "Skills Scanner",
   "description": "Security scanner for OpenClaw Skills to detect potential threats",
-  "version": "1.0.1",
+  "version": "3.0.2",
   "author": "pwddd",
   "skills": ["./skills"],
   "configSchema": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pwddd/skills-scanner",
-  "version": "1.0.3",
+  "version": "3.0.2",
   "description": "OpenClaw Skills security scanner plugin - detect malicious code, data exfiltration, and prompt injection",
   "type": "module",
   "main": "./index.ts",

package/skills/skills-scanner/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: skills-scanner
-description: OpenClaw Skills 安全扫描工具，使用 Cisco AI Skill Scanner 检测恶意代码、数据窃取、提示注入等威胁。
+description: OpenClaw Skills 安全扫描工具，使用 AI Skill Scanner 检测恶意代码、数据窃取、提示注入等威胁。
 version: 1.0.0
 user-invocable: true
 metadata: {"openclaw": {"emoji": "🔍", "requires": {"bins": ["uv", "python3"]}, "install": [{"id": "uv-brew", "kind": "brew", "formula": "uv", "bins": ["uv"], "label": "安装 uv (macOS)", "os": ["darwin"]}, {"id": "uv-curl", "kind": "download", "url": "https://astral.sh/uv/install.sh", "label": "安装 uv (Linux)", "os": ["linux"]}]}}
@@ -366,7 +366,7 @@ https://clawhub.ai/<username>/<project>
 ### 工作原理
 
 1. **接收 URL**：用户提供 ClawHub 项目 URL
-2. **发送请求**：插件将 URL 发送到 skill-scanner-api 服务
+2. **发送请求**：插件将 URL 发送到后端检测服务
 3. **自动下载**：API 服务从 ClawHub 下载 Skill 包（临时）
 4. **执行扫描**：运行静态分析、行为分析、LLM 分析等
 5. **返回结果**：生成安全报告并返回

package/src/high-risk-operation-guard.ts

@@ -0,0 +1,62 @@
+/**
+ * High-risk operation confirmation guidance
+ */
+
+export const HIGH_RISK_OPERATION_GUARD = [
+  "## 🛡️ 高风险操作确认",
+  "",
+  "**在执行可能影响系统或数据的操作前，必须分析风险并要求用户确认。**",
+  "",
+  "### 高风险操作类别",
+  "",
+  "1. **文件系统操作**：删除文件/目录、修改系统配置、写入敏感目录",
+  "2. **网络操作**：下载并执行外部代码、向外部发送数据",
+  "3. **权限操作**：修改权限、执行需要 root/admin 的命令",
+  "4. **数据操作**：删除数据库、清空数据、导出敏感信息",
+  "",
+  "### 风险等级",
+  "",
+  "- 🔴 **高风险**：不可逆操作、影响系统稳定性、涉及敏感数据",
+  "- 🟡 **中风险**：可能影响用户数据、需要特殊权限",
+  "- 🟢 **低风险**：只读操作、可逆操作",
+  "",
+  "### 确认流程",
+  "",
+  "对于高风险和中风险操作：",
+  "",
+  "1. **分析风险**：识别操作类型和潜在后果",
+  "2. **告知用户**：",
+  "   ```",
+  "   ⚠️ 风险提示",
+  "   ",
+  "   操作：[具体操作描述]",
+  "   风险等级：🔴 高风险",
+  "   ",
+  "   潜在后果：",
+  "   - [后果1]",
+  "   - [后果2]",
+  "   ",
+  "   建议：[安全建议]",
+  "   ",
+  "   请确认：你是否要继续执行此操作？",
+  "   ```",
+  "3. **等待确认**：用户必须明确回复\"确认\"、\"继续\"",
+  "",
+  "### 示例",
+  "",
+  "```",
+  "用户: 删除 /data 目录下的所有文件",
+  "AI: ⚠️ 风险提示",
+  "    ",
+  "    操作：删除 /data 目录下的所有文件",
+  "    风险等级：🔴 高风险",
+  "    ",
+  "    潜在后果：",
+  "    - 数据将被永久删除，无法恢复",
+  "    - 可能影响依赖这些文件的应用程序",
+  "    ",
+  "    建议：先备份重要数据",
+  "    ",
+  "    请确认：你是否要继续执行此操作？",
+  "```",
+].join("\n");

package/src/prompt-guidance.ts

@@ -3,23 +3,24 @@
  */
 
 export const SKILLS_SECURITY_GUIDANCE = [
-  "## Skills 安全规则",
+  "## ⚠️ Skills 安全扫描规则（强制执行）",
   "",
-  "当用户请求安装、下载或使用新的 Skill 时，必须先运行安全扫描：",
+  "**当用户请求安装、下载或使用任何 Skill 时，你必须先加载 `skills-scanner` Skill 进行安全扫描。**",
   "",
-  "1. 使用 `/skills-scanner scan <skill路径>` 进行扫描",
-  "2. 等待扫描结果",
-  "3. 根据结果决定：",
-  "   - ✅ 安全（is_safe=true）：可以继续安装，告知用户扫描通过",
-  "   - ❌ 不安全（is_safe=false）：",
-  "     * 立即告知用户发现的安全问题",
-  "     * 显示威胁详情（严重级别、发现数量）",
-  "     * 不得继续安装，除非用户明确要求忽略风险",
+  "### 强制流程",
   "",
-  "对于来自不可信来源的 Skill，使用 `--detailed --behavioral` 进行深度扫描。",
+  "1. **加载 skills-scanner Skill**",
+  "2. **使用该 Skill 执行扫描**",
+  "3. **根据扫描结果决定是否继续**",
   "",
-  "用户明确绕过风险时，必须：",
-  "1. 再次明确告知风险",
-  "2. 要求用户确认（\"我了解风险并仍要继续\"）",
-  "3. 建议用户监控该 Skill 的行为",
+  "### 示例",
+  "",
+  "```",
+  "用户: 帮我安装这个 skill",
+  "AI: 好的，让我先加载 skills-scanner skill 进行安全扫描...",
+  "    [加载并使用 skills-scanner skill]",
+  "    ✅ 扫描通过，可以安装",
+  "```",
+  "",
+  "**禁止**：不得在未使用 skills-scanner Skill 扫描的情况下直接安装。",
 ].join("\n");

package/src/types.ts

@@ -11,6 +11,8 @@ export interface ScannerConfig {
   preInstallScan?: "on" | "off";
   onUnsafe?: "quarantine" | "delete" | "warn";
   injectSecurityGuidance?: boolean;
+  enablePromptInjectionGuard?: boolean;
+  enableHighRiskOperationGuard?: boolean;
 }
 
 export interface ScanState {