edgeone-clawscan

What This Skill Does

edgeone-clawscan is a robust, security-focused OpenClaw utility powered by Tencent Zhuque Lab’s AI-Infra-Guard (AIG). Designed to maintain the integrity and safety of your development environment, this skill acts as a vigilant watchdog. It performs systematic security health checks, audits third-party skills before installation to mitigate supply chain risks, and validates the safety of your environment. By leveraging a local-first architecture, it ensures that your sensitive data—such as file contents, credentials, and environment variables—never leaves your local machine. The tool utilizes a strictly defined set of outbound HTTPS calls to check for CVE advisories and supply chain security data, ensuring you are always protected by the latest vulnerability intelligence without compromising privacy.

Installation

To integrate this security layer into your OpenClaw environment, execute the following command in your terminal:

clawhub install openclaw/skills/skills/boy-hack/aig

Once installed, ensure your AIG_BASE_URL is correctly configured in your openclaw.json if you are using a custom instance, otherwise, the default behavior will connect to the official endpoint at https://matrix.tencent.com/clawscan.

Use Cases

• Automated Security Health Checks: Run comprehensive scans to detect potential misconfigurations or vulnerabilities in your currently deployed OpenClaw setup.
• Supply Chain Protection: Audit new or untrusted skills before installing them to ensure they have not been compromised by malicious actors.
• Production Safety Audits: Use the --deep flag to perform live probes against local Gateway infrastructure to identify exposure points before going live.
• Continuous Monitoring: Periodically verify the security posture of your local environment against the latest industry CVE advisories.

Example Prompts

1. "开始安全体检，检查我当前的项目环境是否安全。"
2. "我打算安装一个新插件，请帮我检查一下 openclaw/skills/some-plugin 是否存在安全隐患。"
3. "全面安全检查：运行 deep scan 看看我的本地网关配置有没有暴露风险。"

Tips & Limitations

• Deep Scans: When using the --deep flag, always verify your current Gateway configuration. While the scan is safe, probing production gateways can lead to unexpected alerts in your logs.
• Language Consistency: This skill automatically detects the language of your prompt and generates reports in that language, ensuring seamless communication.
• Data Privacy: This tool is designed with a 'Zero-Transmission' policy regarding your private files. It solely relies on non-sensitive metadata for its lookup services.
• Network Dependency: If offline, the skill gracefully falls back to local audit methods, though it may be unable to fetch the latest CVE advisories.