@pwddd/skills-scanner 3.0.21 → 3.0.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/openclaw.plugin.json +1 -1
  2. package/package.json +1 -1
  3. package/src/prompt-guidance.ts +31 -2
package/openclaw.plugin.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "id": "skills-scanner",
3
3
  "name": "Skills Scanner",
4
4
  "description": "Security scanner for OpenClaw Skills to detect potential threats",
5
- "version": "3.0.21",
5
+ "version": "3.0.22",
6
6
  "author": "pwddd",
7
7
  "skills": ["./skills"],
8
8
  "configSchema": {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@pwddd/skills-scanner",
3
- "version": "3.0.21",
3
+ "version": "3.0.22",
4
4
  "description": "OpenClaw Skills security scanner plugin - detect malicious code, data exfiltration, and prompt injection",
5
5
  "type": "module",
6
6
  "main": "./index.ts",
package/src/prompt-guidance.ts CHANGED
@@ -95,16 +95,45 @@ export const SKILLS_SECURITY_GUIDANCE = [
95
95
  "",
96
96
  "### 📋 Installation Command Recognition (IMPORTANT)",
97
97
  "",
98
- "**When you see ANY of these patterns, you MUST follow the complete workflow:**",
98
+ "**🔴 CRITICAL RULE: ALL COMMANDS MATCHING INSTALLATION PATTERNS REQUIRE COMPLETE SECURITY WORKFLOW 🔴**",
99
99
  "",
100
+ "**When users send ANY command containing the following installation patterns, you MUST:**",
101
+ "1. STOP immediately",
102
+ "2. Execute STEP 0: `openclaw plugins update skills-scanner`",
103
+ "3. Search for full URL (if only skill name provided)",
104
+ "4. Run security scan",
105
+ "5. Execute installation command ONLY if scan passes",
106
+ "",
107
+ "**⛔ NEVER execute any installation command directly without completing the security workflow above ⛔**",
108
+ "",
109
+ "**Installation command patterns to recognize (ANY command containing these patterns):**",
110
+ "",
111
+ "**Core installation patterns:**",
112
+ "- `clawhub install` ← ANY command with this pattern",
113
+ "- `skill install` ← ANY command with this pattern",
114
+ "- `skills add` ← ANY command with this pattern",
115
+ "- `skills install` ← ANY command with this pattern",
116
+ "",
117
+ "**Examples of commands that trigger this rule:**",
118
+ "- `clawhub install <skill-name>`",
119
+ "- `clawhub install --force <skill-name>`",
120
+ "- `clawhub install --verbose <skill-name>`",
100
121
  "- `openclaw clawhub install <skill-name>`",
101
122
  "- `openclaw skill install <skill-name>`",
102
123
  "- `openclaw skills add <skill-name>`",
103
- "- `clawhub install <skill-name>`",
124
+ "- `openclaw skills install <skill-name>`",
125
+ "- `npx clawhub@latest install <skill-name>`",
126
+ "- `npx @openclaw/clawhub install <skill-name>`",
127
+ "- `npm exec clawhub install <skill-name>`",
128
+ "- `yarn dlx clawhub install <skill-name>`",
129
+ "",
130
+ "**Natural language patterns:**",
104
131
  "- \"install this skill\"",
105
132
  "- \"add this skill\"",
106
133
  "- \"download this skill\"",
107
134
  "- \"setup this skill\"",
135
+ "- \"use npx to install\"",
136
+ "- \"install via clawhub\"",
108
137
  "",
109
138
  "**CRITICAL: ClawHub Installation Workflow**",
110
139
  "",