@pwddd/skills-scanner 3.0.18 → 3.0.20

package/README.md

@@ -386,7 +386,7 @@ openclaw skills-scanner health
 3. **ClawHub 扫描**（聊天命令/CLI）：直接扫描 ClawHub 上的 Skill
 4. **CLI 命令扫描**：通过命令行工具扫描
 5. **自动文件监控**：实时监控目录，自动扫描新 Skill
-6. **定时任务扫描**：每天 08:00 自动生成日报
+6. **定时任务扫描**：每周一 12:05 自动生成周报
 7. **RPC 方法扫描**：供其他插件或程序调用
 8. **AI 主动扫描**：AI 在用户请求安装 Skills 时自动扫描（需启用 `injectSecurityGuidance`）
 

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "skills-scanner",
   "name": "Skills Scanner",
   "description": "Security scanner for OpenClaw Skills to detect potential threats",
-  "version": "3.0.18",
+  "version": "3.0.20",
   "author": "pwddd",
   "skills": ["./skills"],
   "configSchema": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pwddd/skills-scanner",
-  "version": "3.0.18",
+  "version": "3.0.20",
   "description": "OpenClaw Skills security scanner plugin - detect malicious code, data exfiltration, and prompt injection",
   "type": "module",
   "main": "./index.ts",

package/src/commands.ts

@@ -69,16 +69,7 @@ export function createCommandHandlers(
     const recursive = parts.includes("--recursive");
     const isReport = parts.includes("--report");
 
-    if (!targetPath) {
-      return { text: "⚠️ 请指定扫描路径" };
-    }
-
-    if (!existsSync(targetPath)) {
-      return { text: `⚠️ 路径不存在: ${targetPath}` };
-    }
-
-    const isSingleSkill = existsSync(join(targetPath, "SKILL.md"));
-
+    // Report mode: use configured scanDirs
     if (isReport) {
       if (scanDirs.length === 0) {
         return { text: "⚠️ 未找到可扫描目录，请检查配置" };
@@ -94,7 +85,20 @@ export function createCommandHandlers(
         scanScript
       );
       return { text: report };
-    } else if (isSingleSkill) {
+    }
+
+    // Regular scan mode: require path
+    if (!targetPath) {
+      return { text: "⚠️ 请指定扫描路径" };
+    }
+
+    if (!existsSync(targetPath)) {
+      return { text: `⚠️ 路径不存在: ${targetPath}` };
+    }
+
+    const isSingleSkill = existsSync(join(targetPath, "SKILL.md"));
+
+    if (isSingleSkill) {
       const res = await runScan(pythonCmd, scanScript, "scan", targetPath, {
         detailed,
         behavioral: useBehav,

package/src/cron.ts

@@ -181,7 +181,7 @@ async function ensureCronJobViaCLI(logger: any): Promise<void> {
       `--cron "${CRON_SCHEDULE}"`,
       `--tz "${CRON_TIMEZONE}"`,
       "--session isolated",
-      '--message "Please run /skills-scanner scan --report and send results to this channel"',
+      '--message "/skills-scanner scan --report"',
       "--announce",
       "--channel last",
     ].join(" ");
@@ -237,7 +237,7 @@ async function ensureCronJobViaCLI(logger: any): Promise<void> {
       logger.info(`[skills-scanner]     --tz "${CRON_TIMEZONE}" \\`);
       logger.info("[skills-scanner]     --session isolated \\");
       logger.info(
-        '[skills-scanner]     --message "Please run /skills-scanner scan --report and send results to this channel" \\'
+        '[skills-scanner]     --message "/skills-scanner scan --report" \\'
       );
       logger.info("[skills-scanner]     --announce \\");
       logger.info("[skills-scanner]     --channel last");
@@ -271,7 +271,7 @@ export function checkCronJobStatus(logger: any): void {
     logger.info(`[skills-scanner]     --tz "${CRON_TIMEZONE}" \\`);
     logger.info("[skills-scanner]     --session isolated \\");
     logger.info(
-      '[skills-scanner]     --message "Please run /skills-scanner scan --report and send results to this channel" \\'
+      '[skills-scanner]     --message "/skills-scanner scan --report" \\'
     );
     logger.info("[skills-scanner]     --announce \\");
     logger.info("[skills-scanner]     --channel last");

package/src/prompt-guidance.ts

@@ -11,6 +11,30 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "",
   "**This is a SECURITY REQUIREMENT that CANNOT be bypassed under ANY circumstances.**",
   "",
+  "### � IMPORTANT: Read the Skills Scanner Documentation",
+  "",
+  "**Before performing ANY Skill scanning operation, you MUST read the skills-scanner SKILL.md for detailed instructions:**",
+  "",
+  "The SKILL.md contains:",
+  "- Complete scanning workflow and examples",
+  "- API service availability checks",
+  "- Deep analysis and false positive detection guidelines",
+  "- VirusTotal result interpretation",
+  "- ClawHub scanning procedures",
+  "- Command usage examples",
+  "- Troubleshooting guides",
+  "",
+  "**How to access:**",
+  "1. Use the skills system to read the skills-scanner SKILL.md",
+  "2. Review the scanning procedures before executing scans",
+  "3. Follow the documented workflows exactly",
+  "",
+  "**This documentation is CRITICAL for:**",
+  "- Understanding how to properly scan Skills",
+  "- Interpreting scan results correctly",
+  "- Avoiding false positives",
+  "- Handling different scanning scenarios",
+  "",
   "### 🔄 Plugin Update Check (MANDATORY FIRST STEP)",
   "",
   "**Before ANY Skill scanning or installation operation, you MUST update the skills-scanner plugin to the latest version:**",
@@ -44,7 +68,8 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "",
   "### 🔒 Mandatory Workflow (NO EXCEPTIONS - ALWAYS FOLLOW THIS)",
   "",
-  "1. **UPDATE plugin FIRST**: Run `openclaw plugins update skills-scanner` to ensure latest threat detection",
+  "0. **READ documentation FIRST**: Access and read the skills-scanner SKILL.md to understand the complete scanning workflow",
+  "1. **UPDATE plugin**: Run `openclaw plugins update skills-scanner` to ensure latest threat detection",
   "2. **SCAN before operation**: Execute security scan on the target Skill immediately:",
   "   - Local directories (including temporary extraction paths)",
   "   - Remote archives/packages",
@@ -197,6 +222,7 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "### 🧠 Memory Reinforcement",
   "",
   "**Remember: Every time you see a Skill-related operation, ask yourself:**",
+  "0. Have I read the skills-scanner SKILL.md documentation?",
   "1. If it's a ClawHub install with only a name, have I searched for the full URL?",
   "2. Have I updated skills-scanner to the latest version?",
   "3. Have I scanned this Skill yet?",
@@ -204,10 +230,11 @@ export const SKILLS_SECURITY_GUIDANCE = [
   "5. Only if YES to all applicable steps → proceed",
   "",
   "**Complete workflow checklist:**",
+  "- [ ] Read skills-scanner SKILL.md (if first time or unsure)",
   "- [ ] ClawHub name only? → Search first (`openclaw clawhub search <name>`)",
   "- [ ] Update plugin (`openclaw plugins update skills-scanner`)",
   "- [ ] Scan with full URL",
   "- [ ] Scan passed? → Proceed with installation",
   "",
-  "**If you forget to search, update, or scan, you are putting the user's system at risk. Always follow the complete workflow.**",
+  "**If you forget to read documentation, search, update, or scan, you are putting the user's system at risk. Always follow the complete workflow.**",
 ].join("\n");