Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add L-LesterYu/OpenClaw-hot-skills-zh --skill edgeone-clawscan-zhgit clone --depth 1 https://github.com/L-LesterYu/OpenClaw-hot-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/l-lesteryu/openclaw-hot-skills-zh/edgeone-clawscan-zh)<a href="https://agentmods.dev/skills/l-lesteryu/openclaw-hot-skills-zh/edgeone-clawscan-zh"><img src="https://agentmods.dev/badge/skills/l-lesteryu/openclaw-hot-skills-zh/edgeone-clawscan-zh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/l-lesteryu/openclaw-hot-skills-zh/edgeone-clawscan-zh"><img src="https://agentmods.dev/badge/skills/l-lesteryu/openclaw-hot-skills-zh/edgeone-clawscan-zh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00144 | $0.07681 |
| Opus 5 | $0.00072 | $0.03841 |
| Sonnet 5 | $0.00029 | $0.01536 |
| Haiku 4.5 | $0.00014 | $0.00768 |
Grade A, and why
edgeone-clawscan-zh scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://matrix.tencent.com/clawscan/skill_security?skill_name=SKILL_NAME&source=SOURCE" How it starts
The opening of the file, as written. The whole thing — 486 lines — stays where its author put it; the contents beside it link to each section on GitHub.
EdgeOne ClawScan
由 AI-Infra-Guard 驱动的 OpenClaw 安全扫描技能 ( https://github.com/Tencent/AI-Infra-Guard )。
配置
将 AIG_BASE_URL 设置为您的 AI-Infra-Guard 实例地址（默认值：https://matrix.tencent.com/clawscan）。
隐私与外部服务声明
本技能仅出于以下两个特定目的，向 AIG 云服务（matrix.tencent.com/clawscan）发起 HTTPS 请求：
| 请求 | 发送的数据 | 不发送的数据 |
|---|---|---|
| 供应链查询（步骤 2） | 技能名称和来源标签（如 clawhub） |
不发送任何文件内容、凭证或个人数据 |
| CVE 公告查询（步骤 3） | 固定字符串 OpenClaw 和版本号 |
不发送任何文件内容、凭证或个人数据 |
其余所有检查（步骤 1 内建审计和步骤 4 隐私自评估）完全在本地运行。
本技能不会向任何外部服务发送文件内容、凭证、环境变量、会话记录或个人数据。
触发边界
本技能触发后，首先对请求进行分类并保持工作流聚焦：
- 当用户明确要求对当前 OpenClaw 环境进行安全体检或安全扫描时，执行 功能 1：OpenClaw 安全扫描，包括但不限于以下表述：
开始安全体检、做一次安全体检、开始安全扫描、做一次全面安全检查或给 OpenClaw 做安全体检。 - 当用户询问某个技能是否安全、需要进行安装前安全检查或审查一个或多个已安装技能时，执行 功能 2：技能安全扫描。
不要将 openclaw、clawdbot、依赖安装、项目调试或正常开发任务等一般性提及视为运行本技能的理由。
两大核心功能
| 功能 | 描述 | 适用场景 |
|---|---|---|
| OpenClaw 安全扫描 | 完整的系统安全审计（4 个步骤） | 用户明确要求对 OpenClaw 进行全面安全扫描 |
| 技能安全扫描 | 单个技能的安全检测 | 用户询问特定技能安全性、安装前审查或已安装技能审计 |
功能 1：OpenClaw 安全扫描
对整个 OpenClaw 环境执行全面安全审计。静默执行所有 4 个步骤，最终生成一份统一报告。
步骤 1：内建安全审计
运行 OpenClaw 内建安全审计命令：
openclaw security audit --deep
此命令会标记常见的安全隐患，包括：
- Gateway 鉴权与网络暴露
- 工具影响范围与高风险开放房间访问
- 浏览器控制或远程执行暴露
- 文件系统权限与安全配置错误
使用 --deep 运行时，还会尝试对本地 Gateway 进行一次尽力而为的实时探测。
将步骤 1 中的所有内建审计结果视为配置风险提示。
不要将任何单个内建审计结果直接映射为 🔴 高危；应将其视为值得关注和优化的风险点，而非正在发生的严重攻击证据。
在撰写 步骤 1：配置审计 时，仅分析：
openclaw security audit --deep输出的审计结果
不要混入：
- 属于步骤 2 的技能供应链发现
- 属于步骤 2 的本地技能代码审计结果
- 属于步骤 3 的 CVE 或 GHSA 版本公告
- 属于步骤 4 的隐私自评估结论
在最终报告的步骤 1 摘要中：
- 使用直白的语言，聚焦于"存在什么风险"和"如何缩小风险范围"，避免使用"高危"或"严重漏洞"等可能被误解为已确认严重事件的标签。
- 即使某项配置看起来令人担忧，也优先使用"当前配置存在 X 风险，建议调整 Y"等表述，使重点保持在"什么有风险"和"如何更安全"上，而不是贴上吓人的严重性标签。
步骤 2：供应链风险检测
扫描所有已安装技能的供应链风险。
容错规则
云端威胁情报仅为尽力而为，不得阻塞扫描流程。
- 如果 AIG API 请求超时、失败、返回非 200 状态码、返回空内容或无效 JSON，应将云端结果视为不可用，而非安全。
- 当云端查询不可用时，继续对该技能进行本地审计。
- 一个技能的云端查询失败不得阻止对其他技能的检查。
- 本地和 GitHub 来源的技能应默认走本地审计流程，除非有可靠的托管目录结果。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 486 lines · 144 tokens per session scan A 47e2225e120c
edgeone-clawscan-zh is a skill published in the GitHub repository L-LesterYu/OpenClaw-hot-skills-zh (54 stars, last pushed 5mo ago), licensed MIT. It adds 144 tokens to every session and 7,681 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…