edgeone-clawscan

Name: edgeone-clawscan
Author: Tencent

4.2kstars399forks

How to install edgeone-clawscan?

tencent/ai-infra-guard/edgeone-clawscan

$npx -y skills add Tencent/AI-Infra-Guard --skill edgeone-clawscan

Installs into the current project.

Summary

--- name: edgeone-clawscan version: 1.0.15 author: aigsec/Tencent Zhuque Lab license: MIT description: > The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills,

Files · 1

View on GitHub

SKILL.md

1	---
2	name: edgeone-clawscan
3	version: 1.0.15
4	author: aigsec/Tencent Zhuque Lab
5	license: MIT
6	description: >
7	The first security skill to install after setting up OpenClaw — powered by
8	Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits
9	installed skills, scans skills before installation, and performs a full
10	OpenClaw security health check to prevent data leaks and privacy risks.
11	Backed by Tencent Zhuque Lab A.I.G (AI-Infra-Guard).
12	Use when the user asks to start a security health check or security scan for
13	the current OpenClaw environment, such as `开始安全体检`, `做一次安全体检`,
14	`开始安全扫描`, `全面安全检查`, or `检查 OpenClaw 安全`; also use when the
15	user asks to audit a specific skill before installation, review installed
16	skills for supply chain risk, or investigate whether a skill is safe.
17	Do not trigger for general OpenClaw usage, project debugging, environment
18	setup, or normal development requests.
19	Optional cloud mode: set AIG_CLOUD_LOOKUP=off for zero outbound HTTPS; when
20	enabled, only skill_name, source label, and OpenClaw version are sent to
21	A.I.G (never skill bodies, chats, or workspace files).
22	keywords: [security, audit, scan, clawhub, skills, safety, vulnerability, shield, clawscan]
23	triggers:
24	- skill security
25	- scan skill
26	- audit skill
27	- clawscan
28	- tencent clawscan
29	- check skill safety
30	- analyze skill
31	- inspect skill
32	- security review
33	- verify skill
34	- security
35	- claw audit
36	tags: [security, scan, threat-detection, clawscan, claw-audit, claw-shield]
37	external_requests:
38	- url: https://matrix.tencent.com/clawscan/skill_security
39	purpose: >
40	When AIG_CLOUD_LOOKUP is enabled, supply-chain lookup queries the A.I.G
41	threat intelligence database with skill_name and source. Local static
42	analysis alone cannot detect threats added after install via updates nor
43	access a continuously updated community signature set — the API closes
44	that gap. Disable with AIG_CLOUD_LOOKUP=off to skip this call entirely.
45	data_sent: [skill_name, source]
46	failure_mode: graceful_degradation_to_local_audit
47	- url: https://matrix.tencent.com/clawscan/advisories
48	purpose: >
49	When AIG_CLOUD_LOOKUP is enabled, CVE advisory lookup queries the A.I.G
50	database with fixed product name "OpenClaw" and the locally detected
51	version. A current CVE/GHSA corpus cannot be bundled in-skill without
52	going stale — the API provides fresh version-matched advisories. Disable
53	with AIG_CLOUD_LOOKUP=off to skip this call entirely.
54	data_sent: [product_name_fixed_string, version_number]
55	failure_mode: skip_and_report_unavailable
56	live_probe:
57	command: openclaw security audit --deep
58	description: >
59	The --deep flag issues a best-effort live network probe to the locally
60	configured Gateway endpoint only. The probe target is determined by your
61	local openclaw.json; no data is forwarded to any third-party service.
62	Do NOT run against a production Gateway without first reviewing its
63	exposure and access-control settings; run in an isolated or test
64	environment first.
65	binary_caution: >
66	Before execution, verify that `openclaw` on PATH is the intended binary
67	(e.g. `which openclaw` and check the binary origin). A different tool
68	named openclaw could be invoked accidentally.
69	env_vars:
70	- name: AIG_BASE_URL
71	required: false
72	default: https://matrix.tencent.com/clawscan
73	purpose: >
74	Base URL for the AI-Infra-Guard API. Override to point at a self-hosted
75	instance. Defaults to the public Tencent endpoint declared in
76	external_requests above. All curl commands use this variable so the
77	override takes effect automatically.
78	- name: AIG_CLOUD_LOOKUP
79	required: false
80	default: "true"
81	purpose: >
82	Set to 0, false, or off (case-insensitive) to disable every outbound
83	A.I.G HTTPS request. In that mode the skill never sends skill names,
84	sources, or version strings to any remote host; Step 2 and Step 3 fall
85	back to local-only behavior (same as API failure). Use when auditors or
86	policy forbid any default Tencent endpoint regardless of data minimization.
87	provenance:
88	publisher: Tencent Zhuque Lab
89	official_repo: https://github.com/Tencent/AI-Infra-Guard/
90	registry_metadata_caveat: >
91	Skill registries may list a different "owner" or uploader string than
92	author/publisher in this file. That label reflects the distribution channel,
93	not cryptographic proof of origin. Verify this package against official_repo
94	releases, commit history, or signed artifacts before trusting cloud results.
95	verification_note: >
96	Before installation, confirm this package originates from Tencent by checking
97	official repo signatures or a verified publisher at the URL above. If publisher
98	identity cannot be confirmed, treat all cloud lookup results cautiously, set
99	AIG_CLOUD_LOOKUP=off for a zero-outbound scan, or point AIG_BASE_URL at a
100	self-hosted instance y

People who liked this also viewed

6 picks

Type

edgeone-clawscan

4.2kstars399forks

View on GitHub

How to install edgeone-clawscan?

tencent/ai-infra-guard/edgeone-clawscan

$npx -y skills add Tencent/AI-Infra-Guard --skill edgeone-clawscan

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	---
2	name: edgeone-clawscan
3	version: 1.0.15
4	author: aigsec/Tencent Zhuque Lab
5	license: MIT
6	description: >
7	The first security skill to install after setting up OpenClaw — powered by
8	Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits
9	installed skills, scans skills before installation, and performs a full
10	OpenClaw security health check to prevent data leaks and privacy risks.
11	Backed by Tencent Zhuque Lab A.I.G (AI-Infra-Guard).
12	Use when the user asks to start a security health check or security scan for
13	the current OpenClaw environment, such as `开始安全体检`, `做一次安全体检`,
14	`开始安全扫描`, `全面安全检查`, or `检查 OpenClaw 安全`; also use when the
15	user asks to audit a specific skill before installation, review installed
16	skills for supply chain risk, or investigate whether a skill is safe.
17	Do not trigger for general OpenClaw usage, project debugging, environment
18	setup, or normal development requests.
19	Optional cloud mode: set AIG_CLOUD_LOOKUP=off for zero outbound HTTPS; when
20	enabled, only skill_name, source label, and OpenClaw version are sent to
21	A.I.G (never skill bodies, chats, or workspace files).
22	keywords: [security, audit, scan, clawhub, skills, safety, vulnerability, shield, clawscan]
23	triggers:
24	- skill security
25	- scan skill
26	- audit skill
27	- clawscan
28	- tencent clawscan
29	- check skill safety
30	- analyze skill
31	- inspect skill
32	- security review
33	- verify skill
34	- security
35	- claw audit
36	tags: [security, scan, threat-detection, clawscan, claw-audit, claw-shield]
37	external_requests:
38	- url: https://matrix.tencent.com/clawscan/skill_security
39	purpose: >
40	When AIG_CLOUD_LOOKUP is enabled, supply-chain lookup queries the A.I.G
41	threat intelligence database with skill_name and source. Local static
42	analysis alone cannot detect threats added after install via updates nor
43	access a continuously updated community signature set — the API closes
44	that gap. Disable with AIG_CLOUD_LOOKUP=off to skip this call entirely.
45	data_sent: [skill_name, source]
46	failure_mode: graceful_degradation_to_local_audit
47	- url: https://matrix.tencent.com/clawscan/advisories
48	purpose: >
49	When AIG_CLOUD_LOOKUP is enabled, CVE advisory lookup queries the A.I.G
50	database with fixed product name "OpenClaw" and the locally detected
51	version. A current CVE/GHSA corpus cannot be bundled in-skill without
52	going stale — the API provides fresh version-matched advisories. Disable
53	with AIG_CLOUD_LOOKUP=off to skip this call entirely.
54	data_sent: [product_name_fixed_string, version_number]
55	failure_mode: skip_and_report_unavailable
56	live_probe:
57	command: openclaw security audit --deep
58	description: >
59	The --deep flag issues a best-effort live network probe to the locally
60	configured Gateway endpoint only. The probe target is determined by your
61	local openclaw.json; no data is forwarded to any third-party service.
62	Do NOT run against a production Gateway without first reviewing its
63	exposure and access-control settings; run in an isolated or test
64	environment first.
65	binary_caution: >
66	Before execution, verify that `openclaw` on PATH is the intended binary
67	(e.g. `which openclaw` and check the binary origin). A different tool
68	named openclaw could be invoked accidentally.
69	env_vars:
70	- name: AIG_BASE_URL
71	required: false
72	default: https://matrix.tencent.com/clawscan
73	purpose: >
74	Base URL for the AI-Infra-Guard API. Override to point at a self-hosted
75	instance. Defaults to the public Tencent endpoint declared in
76	external_requests above. All curl commands use this variable so the
77	override takes effect automatically.
78	- name: AIG_CLOUD_LOOKUP
79	required: false
80	default: "true"
81	purpose: >
82	Set to 0, false, or off (case-insensitive) to disable every outbound
83	A.I.G HTTPS request. In that mode the skill never sends skill names,
84	sources, or version strings to any remote host; Step 2 and Step 3 fall
85	back to local-only behavior (same as API failure). Use when auditors or
86	policy forbid any default Tencent endpoint regardless of data minimization.
87	provenance:
88	publisher: Tencent Zhuque Lab
89	official_repo: https://github.com/Tencent/AI-Infra-Guard/
90	registry_metadata_caveat: >
91	Skill registries may list a different "owner" or uploader string than
92	author/publisher in this file. That label reflects the distribution channel,
93	not cryptographic proof of origin. Verify this package against official_repo
94	releases, commit history, or signed artifacts before trusting cloud results.
95	verification_note: >
96	Before installation, confirm this package originates from Tencent by checking
97	official repo signatures or a verified publisher at the URL above. If publisher
98	identity cannot be confirmed, treat all cloud lookup results cautiously, set
99	AIG_CLOUD_LOOKUP=off for a zero-outbound scan, or point AIG_BASE_URL at a
100	self-hosted instance y

People who liked this also viewed

6 picks

Type