Skip to content
cccskills
FreePublished on GitHub

byted-security-skillsscanner

审计和扫描技能的安全性。当用户希望对工作区中的其他技能进行安全扫描时使用。

The English summary is being prepared. Showing the original description.

Run score Not tested

See how to install

Files included (5)

  • SKILL.md2.4 KB
  • LICENSE11.1 KB
  • README.md2.4 KB
  • requirements.txt84 B
  • scripts/scan.py16.6 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Volcengine技能安全扫描器 (Volcengine Skills Scanner)

通过将技能目录打包并上传火山引擎安全扫描服务进行扫描,审计工作区中的其他技能是否存在潜在的安全风险。

何时使用

  • 审计:定期扫描所有技能以确保符合安全策略。
  • 开发:在开发过程中检查自己的技能。
  • 要求:必须确保目标技能包含 SKILL.md 文件,因为它是扫描的主要输入。

用法

使用 scripts/scan.py 脚本执行扫描。必须使用绝对路径,不要使用~,因为运行目录不是 skill 目录。

脚本会自动打包目录(如果提供的是目录)并上传,始终输出包含扫描结果的 JSON 数组。解析此JSON并以易读的格式(中文)向用户展示结果(风险等级、详细信息、建议)。

扫描技能(目录或压缩包)

脚本通过环境变量读取配置(推荐)

python3 ~/.openclaw/workspace/skills/byted-security-skillsscanner/scripts/scan.py --name "bad_skills1" --path "/root/.openclaw/workspace/skills/bad_skills1"

重要:

  • 脚本路径必须是绝对路径
  • 目标路径也必须是绝对路径
  • 确保已设置必要的环境变量(VOLCENGINE_ACCESS_KEY、VOLCENGINE_SECRET_KEY、VOLCENGINE_REGION)

报告格式

向用户展示结果时,必须使用以下格式(中文):

🛡️ 安全扫描报告:[SkillName]

扫描时间: [将 ScanEndTime 时间戳转换为可读日期格式] 整体状态: [✅ 通过 / ❌ 发现风险]

风险等级规则名称风险详情
[High/Medium/Low][RuleName][RiskDetail]

发现的风险列表: (仅列出 High 和 Medium 级别的风险)

  1. [RuleName] (ID: [RuleID])
    • 等级: [RiskLevel]
    • 文件: [FileName]
    • 详情: [RiskDetail]
    • 建议: 请检查上述文件中的代码,移除可疑的网络请求或敏感操作。

环境变量配置

  1. 获取火山引擎访问凭证:参考 用户指南 获取 AK/SK

  2. 配置以下环境变量:

export VOLC_ACCESS_KEY="your-access-key"
export VOLC_SECRET_KEY="your-secret-key"
export VOLC_REGION="cn-north-1"  # 可选,默认 cn-north-1

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Deploy, update, validate, and troubleshoot the AgentKit hybrid-cloud customer-service demo in this directory. Use when a user asks an AI coding agent to follow the README, deploy or update the demo, configure OpenAPI/Runtime/Knowledge/Memory/Sandbox/MCP/Skills/A2A, run customer-view validation, or record manual platform steps and failures.

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

Generate deterministic SVG algorithmic artwork. Invoke when the user asks for geometric, generative, or algorithmic visual art.

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

通过本地 Python CLI 和 OpenAPI 客户端管理、排查火山云手机资源。适用于查询实例和资源、截图、执行命令、查看任务、检查应用、主机和机房容量、标签、DNS、路由,以及操作已授权的测试云手机实例。

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

Launch and continue the Volcengine AI Research survey workflow for concept testing, audience design, questionnaire drafting, interview guide generation, execution confirmation, progress checks, and result queries. Use this skill when the user wants to create, revise, confirm, execute, or follow up on a real AI research survey task in ABCompass instead of doing generic brainstorming, copywriting, translation, summarization, or broad market discussion.

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

Create and check long-running video material evaluation tasks. Use this skill when the user wants to submit videos for evaluation, check an existing video evaluation task list, or fetch the result of a previously created video evaluation task. This skill is not a general-purpose video upload skill because upload is allowed only as an internal step of task creation. Authentication uses an API key passed as an Authorization bearer token.

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

火山引擎 AntiDDoSPro 高防域名只读巡检。用户要查域名健康、攻击、流量、CC/WAF/区域封禁、智能防护或 CCAI 状态时使用。

The English summary is being prepared. Showing the original description.

bytedance/agentkit-samples473Updated Oct 22, 2026

See all skills by bytedance

Report a problem with this skill