[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PY3G34PA7RF9C219SW3QFG":3,"skill-same:01M6PY3G34PA7RF9C219SW3QFG":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":60,"updatedAt":61,"install":62,"resources":75},"01M6PY3G34PA7RF9C219SW3QFG","flaw0",null,"Security and vulnerability scanner for OpenClaw code, plugins, skills, and Node.js dependencies. Powered by OpenClaw AI models.","Kernel8901\u002Fai-agent-skills-classification","Kernel8901","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F72647553?v=4","01M6KV388J2H5PNC8D8P940BJD","01M6KV38CS5B3AY63RKZB410YM",7,"MIT","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F安全与密码\u002Fflaw0\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[5,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"models","for","checker","dependency-checker","vulnerability-scanner","ai models","code-analysis","dependencies","scanner","openclaw","dependency","node","vulnerability scanner","vulnerability","analysis","https","code","security","github","2026-11-10 10:12:30",false,"---\nname: flaw0\ndescription: Security and vulnerability scanner for OpenClaw code, plugins, skills, and Node.js dependencies. Powered by OpenClaw AI models.\nversion: 1.0.0\nauthor: Tom\nhomepage: https:\u002F\u002Fgithub.com\u002Fyourusername\u002Fflaw0\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"?\"\n    category: \"security\"\ntags:\n  - security\n  - vulnerability-scanner\n  - code-analysis\n  - dependency-checker\n  - openclaw\n---\n\n# flaw0 - Zero Flaws Security Scanner\n\nSecurity and vulnerability scanner for OpenClaw ecosystems. Analyzes source code, plugins, skills, and Node.js dependencies to detect potential security flaws.\n\n**Goal: Achieve flaw 0** (zero flaws detected) ?\n\n## Installation\n\nInstall this skill via [ClawHub](https:\u002F\u002Fwww.clawhub.ai):\n\n```bash\nnpx clawhub@latest install flaw0\n```\n\nOr install globally via npm:\n\n```bash\nnpm install -g flaw0\n```\n\n## When to Use This Skill\n\nUse **flaw0** to ensure your OpenClaw code and dependencies are secure:\n\n### Before Installing Skills\n\n```bash\n# Check a skill before installing\nflaw0 scan ~\u002F.openclaw\u002Fskills\u002Fnew-skill\n```\n\n### During Development\n\n```bash\n# Scan your code as you develop\nflaw0 scan src\u002F\n\n# Check dependencies\nflaw0 deps\n```\n\n### Before Committing\n\n```bash\n# Full security audit\nflaw0 audit\n```\n\n### Auditing OpenClaw Installation\n\n```bash\n# Scan all OpenClaw components\nflaw0 scan --target all\n\n# Check specific components\nflaw0 scan --target skills\nflaw0 scan --target plugins\nflaw0 scan --target core\n```\n\n## Usage\n\n### Basic Commands\n\n#### Scan Code\n\n```bash\n# Scan current directory\nflaw0 scan\n\n# Scan specific directory\nflaw0 scan \u002Fpath\u002Fto\u002Fcode\n\n# Use specific AI model\nflaw0 scan --model claude-opus-4-6\n```\n\n#### Check Dependencies\n\n```bash\n# Quick dependency scan\nflaw0 deps\n\n# Deep scan (entire dependency tree)\nflaw0 deps --deep\n```\n\n#### Full Security Audit\n\n```bash\n# Comprehensive scan (code + dependencies)\nflaw0 audit\n\n# Save report to file\nflaw0 audit --output report.json\n\n# JSON output for CI\u002FCD\nflaw0 audit --json\n```\n\n#### Scan OpenClaw Components\n\n```bash\n# Scan OpenClaw core\nflaw0 scan --target core\n\n# Scan all plugins\nflaw0 scan --target plugins\n\n# Scan all skills\nflaw0 scan --target skills\n\n# Scan everything\nflaw0 scan --target all\n```\n\n## What flaw0 Detects\n\n### Code Vulnerabilities (12+ Types)\n\n1. **Command Injection**\n   - `exec()` with unsanitized input\n   - Shell command construction with user input\n\n2. **Code Injection**\n   - `eval()` usage\n   - `Function()` constructor with strings\n\n3. **SQL Injection**\n   - String concatenation in SQL queries\n   - Unparameterized queries\n\n4. **Cross-Site Scripting (XSS)**\n   - `innerHTML` assignments\n   - `dangerouslySetInnerHTML` usage\n\n5. **Path Traversal**\n   - Unvalidated file path operations\n   - `readFile()` with user input\n\n6. **Hardcoded Secrets**\n   - API keys in source code\n   - Passwords and tokens\n   - AWS credentials\n\n7. **Weak Cryptography**\n   - MD5 and SHA1 usage\n   - Weak hashing algorithms\n\n8. **Insecure Randomness**\n   - `Math.random()` for security operations\n   - Predictable token generation\n\n9. **Unsafe Deserialization**\n   - `JSON.parse()` without validation\n   - Unvalidated input parsing\n\n10. **Missing Authentication**\n    - API endpoints without auth middleware\n    - Unprotected routes\n\n### Dependency Issues\n\n1. **Known CVEs** - Vulnerabilities from CVE database\n2. **Outdated Packages** - Packages with security updates available\n3. **Malicious Packages** - Known malware or suspicious packages\n4. **Duplicate Dependencies** - Bloated dependency trees\n\n## Understanding Results\n\n### Flaw Score\n\nResults are reported with a **flaw score** - lower is better:\n\n- **flaw 0** ? - Perfect! No issues detected\n- **flaw 1-3** ? - Minor issues\n- **flaw 4-10** ? - Needs attention\n- **flaw 10+** ? - Critical issues\n\n### Score Calculation\n\nEach issue is weighted by severity:\n- **Critical**: 3 points\n- **High**: 2 points\n- **Medium**: 1 point\n- **Low**: 0.5 points\n\n**Total flaw score** = sum of all weighted issues (rounded)\n\n### Example Output\n\n#### Clean Code (flaw 0)\n\n```\n? flaw0 Security Scan Results\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n? Result: flaw 0\n✅ Status: SECURE\n\n✓ No security issues detected!\n✓ All checks passed\n\nGreat job! ?\n```\n\n#### Issues Found (flaw 12)\n\n```\n? flaw0 Security Scan Results\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n? Result: flaw 12\n⚠️  Status: ISSUES FOUND\n\nCode Flaws: 5\n├─ ? Critical: 2\n├─ ? High: 1\n├─ ? Medium: 2\n└─ ⚪ Low: 0\n\nDependency Flaws: 7\n├─ ? Critical CVEs: 3\n├─ ? High CVEs: 2\n├─ ? Medium: 2\n└─ ⚪ Low: 0\n\nDetailed Report:\n─────────────────────────────────\n\n1. [CRITICAL] Command Injection\n   Location: src\u002Fexecutor.js:78\n   Code: `exec(\\`ls ${userInput}\\`)`\n   Description: Unsanitized exec() call\n   → Fix: Use execFile() or validate input\n   ? AI Confidence: high\n   ? AI Suggestion: Replace exec() with execFile()\n      and validate input against whitelist\n\n2. [HIGH] Hardcoded API Key\n   Location: config\u002Fapi.js:5\n   Code: `const API_KEY = \"sk-1234...\"`\n   Description: API key exposed in source code\n   → Fix: Use process.env.API_KEY\n\n3. [CRITICAL] CVE-2024-12345 in lodash@4.17.19\n   Package: lodash@4.17.19\n   Description: Prototype pollution vulnerability\n   → Fix: npm install lodash@4.17.21\n\n...\n```\n\n## AI-Powered Analysis\n\nflaw0 uses OpenClaw's AI models for intelligent code review:\n\n### Available Models\n\n#### claude-sonnet-4-5 (default)\n- Balanced speed and accuracy\n- Best for most use cases\n- Good false positive reduction\n\n```bash\nflaw0 scan --model claude-sonnet-4-5\n```\n\n#### claude-opus-4-6\n- Most thorough analysis\n- Deepest context understanding\n- Slower but most accurate\n\n```bash\nflaw0 scan --model claude-opus-4-6\n```\n\n#### claude-haiku-4-5\n- Fastest scanning\n- Good for quick checks\n- Use in CI\u002FCD for speed\n\n```bash\nflaw0 scan --model claude-haiku-4-5\n```\n\n### AI Features\n\n- **Context-aware analysis** - Understands code flow and context\n- **False positive reduction** - Filters out non-issues\n- **Confidence scoring** - Rates detection confidence\n- **Fix suggestions** - Provides specific remediation steps\n\n## Configuration\n\n### Create Config File\n\n```bash\nflaw0 init\n```\n\nThis creates `.flaw0rc.json`:\n\n```json\n{\n  \"severity\": {\n    \"failOn\": \"high\",\n    \"ignore\": [\"low\"]\n  },\n  \"targets\": {\n    \"code\": true,\n    \"dependencies\": true,\n    \"devDependencies\": false\n  },\n  \"exclude\": [\n    \"node_modules\u002F**\",\n    \"test\u002F**\",\n    \"*.test.js\"\n  ],\n  \"model\": \"claude-sonnet-4-5\",\n  \"maxFlawScore\": 0\n}\n```\n\n### Configuration Options\n\n- **severity.failOn** - Exit with error on this severity level or higher\n- **severity.ignore** - Skip these severity levels\n- **targets** - What to scan (code, dependencies)\n- **exclude** - File patterns to ignore\n- **model** - AI model to use\n- **maxFlawScore** - Maximum acceptable flaw score\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Security Scan\n\non: [push, pull_request]\n\njobs:\n  flaw0:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v3\n      - uses: actions\u002Fsetup-node@v3\n\n      - name: Install flaw0\n        run: npm install -g flaw0\n\n      - name: Run security scan\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: flaw0 audit\n\n      - name: Check flaw score\n        run: |\n          SCORE=$(flaw0 audit --json | jq '.flawScore')\n          if [ \"$SCORE\" -gt 0 ]; then\n            echo \"❌ Flaws detected: flaw $SCORE\"\n            exit 1\n          fi\n          echo \"✅ No flaws: flaw 0\"\n```\n\n### Pre-commit Hook\n\n```bash\n#!\u002Fbin\u002Fbash\necho \"? Running flaw0 scan...\"\nflaw0 scan\n\nif [ $? -ne 0 ]; then\n  echo \"❌ Flaws detected! Commit blocked.\"\n  exit 1\nfi\n```\n\n## Examples\n\n### Scan Before Installing a Skill\n\n```bash\n# Download a skill to review\ngit clone https:\u002F\u002Fgithub.com\u002Fuser\u002Fsome-skill.git \u002Ftmp\u002Fsome-skill\n\n# Scan it\nflaw0 scan \u002Ftmp\u002Fsome-skill\n\n# If flaw 0, safe to install\n# If flaw > 0, review issues first\n```\n\n### Audit Your OpenClaw Skills\n\n```bash\n# Scan all installed skills\nflaw0 scan --target skills\n\n# Example output:\n# ✓ clawdex - flaw 0\n# ✓ database-helper - flaw 0\n# ⚠ crypto-bot - flaw 3\n# ✓ git-assistant - flaw 0\n# Overall: flaw 3\n```\n\n### Check Dependencies After Install\n\n```bash\n# After installing new packages\nnpm install some-package\n\n# Check for vulnerabilities\nflaw0 deps\n```\n\n### Full Project Audit\n\n```bash\n# Comprehensive security check\nflaw0 audit --output security-report.json\n\n# Review the report\ncat security-report.json | jq '.flawScore'\n```\n\n## API Usage\n\nUse flaw0 programmatically in your own tools:\n\n```javascript\nconst Flaw0 = require('flaw0');\n\nconst scanner = new Flaw0({\n  target: '.\u002Fsrc',\n  model: 'claude-sonnet-4-5'\n});\n\n\u002F\u002F Run full scan\nconst results = await scanner.scan();\n\nconsole.log(`Flaw Score: ${results.flawScore}`);\n\nif (results.flawScore === 0) {\n  console.log('✅ No flaws detected!');\n} else {\n  results.codeFlaws.forEach(flaw => {\n    console.log(`[${flaw.severity}] ${flaw.name}`);\n    console.log(`  Location: ${flaw.file}:${flaw.line}`);\n    console.log(`  Fix: ${flaw.fix}`);\n  });\n}\n```\n\n## How It Works\n\n1. **Pattern Matching** - Fast regex-based detection of common vulnerabilities\n2. **AI Analysis** - Claude AI reviews each issue in context\n3. **False Positive Filtering** - AI identifies and removes non-issues\n4. **Dependency Checking** - Integrates with npm audit and CVE databases\n5. **Scoring** - Calculates weighted flaw score\n6. **Reporting** - Generates detailed, actionable reports\n\n## Tips for Achieving flaw 0\n\n1. **Fix Critical issues first** - Biggest security impact\n2. **Update dependencies** - Resolve known CVEs quickly\n3. **Use parameterized queries** - Prevent SQL injection\n4. **Validate all inputs** - Stop injection attacks\n5. **Use environment variables** - No hardcoded secrets\n6. **Apply security headers** - Use helmet.js\n7. **Implement authentication** - Protect all endpoints\n8. **Use strong crypto** - SHA-256 or better\n9. **Sanitize output** - Prevent XSS\n10. **Review AI suggestions** - Learn from recommendations\n\n## Comparison with Other Tools\n\n| Feature | flaw0 | npm audit | Snyk | ESLint Security |\n|---------|-------|-----------|------|-----------------|\n| Dependency CVEs | ✅ | ✅ | ✅ | ❌ |\n| AI Code Analysis | ✅ | ❌ | ❌ | ❌ |\n| OpenClaw-specific | ✅ | ❌ | ❌ | ❌ |\n| Context-aware | ✅ | ❌ | ⚠️ | ⚠️ |\n| False positive reduction | ✅ | ❌ | ⚠️ | ❌ |\n| Fix suggestions | ✅ | ⚠️ | ✅ | ⚠️ |\n\n## Requirements\n\n- **Node.js**: 14+\n- **API Key**: Anthropic API key for AI analysis\n- **npm**: For dependency checking\n\n### Setup API Key\n\n```bash\nexport ANTHROPIC_API_KEY='your-api-key-here'\n```\n\nGet your API key from: https:\u002F\u002Fconsole.anthropic.com\u002F\n\n## Troubleshooting\n\n### \"No API key found\"\n\n```bash\nexport ANTHROPIC_API_KEY='sk-...'\n# Or add to ~\u002F.bashrc or ~\u002F.zshrc\n```\n\n### \"npm audit failed\"\n\nEnsure you have a valid package.json:\n\n```bash\nnpm init -y\nnpm install\n```\n\n### Rate Limit Exceeded\n\nIf you hit API rate limits:\n1. Use haiku model: `--model haiku`\n2. Scan smaller portions\n3. Wait and retry\n\n## Support\n\n- **Documentation**: See USAGE.md for detailed guide\n- **Examples**: Check examples\u002F directory\n- **Issues**: Report at GitHub repository\n- **Demo**: Run `.\u002Fdemo.sh` for interactive demo\n\n## About\n\n**flaw0** helps the OpenClaw community achieve secure, vulnerability-free code.\n\n- Built with OpenClaw\u002FClaude AI\n- Uses industry-standard security patterns\n- Continuously updated with new vulnerabilities\n- Open source under MIT license\n\n## Contributing\n\nContributions welcome! Areas for contribution:\n- New vulnerability patterns\n- Additional AI models\n- Python\u002FGo support\n- Web dashboard\n- Custom rule engine\n\n## License\n\nMIT License - see LICENSE file\n\n---\n\n**Goal: flaw 0 for everyone! ?**\n\n**Remember**: Security is not a one-time check. Run flaw0 regularly to maintain **flaw 0** status!\n","# flaw0 - Zero Flaws Security Scanner\n\nSecurity and vulnerability scanner for OpenClaw ecosystems. Analyzes source code, plugins, skills, and Node.js dependencies to detect potential security flaws.\n\n**Goal: Achieve flaw 0** (zero flaws detected) ?\n\n## Installation\n\nInstall this skill via [ClawHub](https:\u002F\u002Fwww.clawhub.ai):\n\n```bash\nnpx clawhub@latest install flaw0\n```\n\nOr install globally via npm:\n\n```bash\nnpm install -g flaw0\n```\n\n## When to Use This Skill\n\nUse **flaw0** to ensure your OpenClaw code and dependencies are secure:\n\n### Before Installing Skills\n\n```bash\n# Check a skill before installing\nflaw0 scan ~\u002F.openclaw\u002Fskills\u002Fnew-skill\n```\n\n### During Development\n\n```bash\n# Scan your code as you develop\nflaw0 scan src\u002F\n\n# Check dependencies\nflaw0 deps\n```\n\n### Before Committing\n\n```bash\n# Full security audit\nflaw0 audit\n```\n\n### Auditing OpenClaw Installation\n\n```bash\n# Scan all OpenClaw components\nflaw0 scan --target all\n\n# Check specific components\nflaw0 scan --target skills\nflaw0 scan --target plugins\nflaw0 scan --target core\n```\n\n## Usage\n\n### Basic Commands\n\n#### Scan Code\n\n```bash\n# Scan current directory\nflaw0 scan\n\n# Scan specific directory\nflaw0 scan \u002Fpath\u002Fto\u002Fcode\n\n# Use specific AI model\nflaw0 scan --model claude-opus-4-6\n```\n\n#### Check Dependencies\n\n```bash\n# Quick dependency scan\nflaw0 deps\n\n# Deep scan (entire dependency tree)\nflaw0 deps --deep\n```\n\n#### Full Security Audit\n\n```bash\n# Comprehensive scan (code + dependencies)\nflaw0 audit\n\n# Save report to file\nflaw0 audit --output report.json\n\n# JSON output for CI\u002FCD\nflaw0 audit --json\n```\n\n#### Scan OpenClaw Components\n\n```bash\n# Scan OpenClaw core\nflaw0 scan --target core\n\n# Scan all plugins\nflaw0 scan --target plugins\n\n# Scan all skills\nflaw0 scan --target skills\n\n# Scan everything\nflaw0 scan --target all\n```\n\n## What flaw0 Detects\n\n### Code Vulnerabilities (12+ Types)\n\n1. **Command Injection**\n   - `exec()` with unsanitized input\n   - Shell command construction with user input\n\n2. **Code Injection**\n   - `eval()` usage\n   - `Function()` constructor with strings\n\n3. **SQL Injection**\n   - String concatenation in SQL queries\n   - Unparameterized queries\n\n4. **Cross-Site Scripting (XSS)**\n   - `innerHTML` assignments\n   - `dangerouslySetInnerHTML` usage\n\n5. **Path Traversal**\n   - Unvalidated file path operations\n   - `readFile()` with user input\n\n6. **Hardcoded Secrets**\n   - API keys in source code\n   - Passwords and tokens\n   - AWS credentials\n\n7. **Weak Cryptography**\n   - MD5 and SHA1 usage\n   - Weak hashing algorithms\n\n8. **Insecure Randomness**\n   - `Math.random()` for security operations\n   - Predictable token generation\n\n9. **Unsafe Deserialization**\n   - `JSON.parse()` without validation\n   - Unvalidated input parsing\n\n10. **Missing Authentication**\n    - API endpoints without auth middleware\n    - Unprotected routes\n\n### Dependency Issues\n\n1. **Known CVEs** - Vulnerabilities from CVE database\n2. **Outdated Packages** - Packages with security updates available\n3. **Malicious Packages** - Known malware or suspicious packages\n4. **Duplicate Dependencies** - Bloated dependency trees\n\n## Understanding Results\n\n### Flaw Score\n\nResults are reported with a **flaw score** - lower is better:\n\n- **flaw 0** ? - Perfect! No issues detected\n- **flaw 1-3** ? - Minor issues\n- **flaw 4-10** ? - Needs attention\n- **flaw 10+** ? - Critical issues\n\n### Score Calculation\n\nEach issue is weighted by severity:\n- **Critical**: 3 points\n- **High**: 2 points\n- **Medium**: 1 point\n- **Low**: 0.5 points\n\n**Total flaw score** = sum of all weighted issues (rounded)\n\n### Example Output\n\n#### Clean Code (flaw 0)\n\n```\n? flaw0 Security Scan Results\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n? Result: flaw 0\n✅ Status: SECURE\n\n✓ No security issues detected!\n✓ All checks passed\n\nGreat job! ?\n```\n\n#### Issues Found (flaw 12)\n\n```\n? flaw0 Security Scan Results\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n? Result: flaw 12\n⚠️  Status: ISSUES FOUND\n\nCode Flaws: 5\n├─ ? Critical: 2\n├─ ? High: 1\n├─ ? Medium: 2\n└─ ⚪ Low: 0\n\nDependency Flaws: 7\n├─ ? Critical CVEs: 3\n├─ ? High CVEs: 2\n├─ ? Medium: 2\n└─ ⚪ Low: 0\n\nDetailed Report:\n─────────────────────────────────\n\n1. [CRITICAL] Command Injection\n   Location: src\u002Fexecutor.js:78\n   Code: `exec(\\`ls ${userInput}\\`)`\n   Description: Unsanitized exec() call\n   → Fix: Use execFile() or validate input\n   ? AI Confidence: high\n   ? AI Suggestion: Replace exec() with execFile()\n      and validate input against whitelist\n\n2. [HIGH] Hardcoded API Key\n   Location: config\u002Fapi.js:5\n   Code: `const API_KEY = \"sk-1234...\"`\n   Description: API key exposed in source code\n   → Fix: Use process.env.API_KEY\n\n3. [CRITICAL] CVE-2024-12345 in lodash@4.17.19\n   Package: lodash@4.17.19\n   Description: Prototype pollution vulnerability\n   → Fix: npm install lodash@4.17.21\n\n...\n```\n\n## AI-Powered Analysis\n\nflaw0 uses OpenClaw's AI models for intelligent code review:\n\n### Available Models\n\n#### claude-sonnet-4-5 (default)\n- Balanced speed and accuracy\n- Best for most use cases\n- Good false positive reduction\n\n```bash\nflaw0 scan --model claude-sonnet-4-5\n```\n\n#### claude-opus-4-6\n- Most thorough analysis\n- Deepest context understanding\n- Slower but most accurate\n\n```bash\nflaw0 scan --model claude-opus-4-6\n```\n\n#### claude-haiku-4-5\n- Fastest scanning\n- Good for quick checks\n- Use in CI\u002FCD for speed\n\n```bash\nflaw0 scan --model claude-haiku-4-5\n```\n\n### AI Features\n\n- **Context-aware analysis** - Understands code flow and context\n- **False positive reduction** - Filters out non-issues\n- **Confidence scoring** - Rates detection confidence\n- **Fix suggestions** - Provides specific remediation steps\n\n## Configuration\n\n### Create Config File\n\n```bash\nflaw0 init\n```\n\nThis creates `.flaw0rc.json`:\n\n```json\n{\n  \"severity\": {\n    \"failOn\": \"high\",\n    \"ignore\": [\"low\"]\n  },\n  \"targets\": {\n    \"code\": true,\n    \"dependencies\": true,\n    \"devDependencies\": false\n  },\n  \"exclude\": [\n    \"node_modules\u002F**\",\n    \"test\u002F**\",\n    \"*.test.js\"\n  ],\n  \"model\": \"claude-sonnet-4-5\",\n  \"maxFlawScore\": 0\n}\n```\n\n### Configuration Options\n\n- **severity.failOn** - Exit with error on this severity level or higher\n- **severity.ignore** - Skip these severity levels\n- **targets** - What to scan (code, dependencies)\n- **exclude** - File patterns to ignore\n- **model** - AI model to use\n- **maxFlawScore** - Maximum acceptable flaw score\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n\n```yaml\nname: Security Scan\n\non: [push, pull_request]\n\njobs:\n  flaw0:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v3\n      - uses: actions\u002Fsetup-node@v3\n\n      - name: Install flaw0\n        run: npm install -g flaw0\n\n      - name: Run security scan\n        env:\n          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}\n        run: flaw0 audit\n\n      - name: Check flaw score\n        run: |\n          SCORE=$(flaw0 audit --json | jq '.flawScore')\n          if [ \"$SCORE\" -gt 0 ]; then\n            echo \"❌ Flaws detected: flaw $SCORE\"\n            exit 1\n          fi\n          echo \"✅ No flaws: flaw 0\"\n```\n\n### Pre-commit Hook\n\n```bash\n#!\u002Fbin\u002Fbash\necho \"? Running flaw0 scan...\"\nflaw0 scan\n\nif [ $? -ne 0 ]; then\n  echo \"❌ Flaws detected! Commit blocked.\"\n  exit 1\nfi\n```\n\n## Examples\n\n### Scan Before Installing a Skill\n\n```bash\n# Download a skill to review\ngit clone https:\u002F\u002Fgithub.com\u002Fuser\u002Fsome-skill.git \u002Ftmp\u002Fsome-skill\n\n# Scan it\nflaw0 scan \u002Ftmp\u002Fsome-skill\n\n# If flaw 0, safe to install\n# If flaw > 0, review issues first\n```\n\n### Audit Your OpenClaw Skills\n\n```bash\n# Scan all installed skills\nflaw0 scan --target skills\n\n# Example output:\n# ✓ clawdex - flaw 0\n# ✓ database-helper - flaw 0\n# ⚠ crypto-bot - flaw 3\n# ✓ git-assistant - flaw 0\n# Overall: flaw 3\n```\n\n### Check Dependencies After Install\n\n```bash\n# After installing new packages\nnpm install some-package\n\n# Check for vulnerabilities\nflaw0 deps\n```\n\n### Full Project Audit\n\n```bash\n# Comprehensive security check\nflaw0 audit --output security-report.json\n\n# Review the report\ncat security-report.json | jq '.flawScore'\n```\n\n## API Usage\n\nUse flaw0 programmatically in your own tools:\n\n```javascript\nconst Flaw0 = require('flaw0');\n\nconst scanner = new Flaw0({\n  target: '.\u002Fsrc',\n  model: 'claude-sonnet-4-5'\n});\n\n\u002F\u002F Run full scan\nconst results = await scanner.scan();\n\nconsole.log(`Flaw Score: ${results.flawScore}`);\n\nif (results.flawScore === 0) {\n  console.log('✅ No flaws detected!');\n} else {\n  results.codeFlaws.forEach(flaw => {\n    console.log(`[${flaw.severity}] ${flaw.name}`);\n    console.log(`  Location: ${flaw.file}:${flaw.line}`);\n    console.log(`  Fix: ${flaw.fix}`);\n  });\n}\n```\n\n## How It Works\n\n1. **Pattern Matching** - Fast regex-based detection of common vulnerabilities\n2. **AI Analysis** - Claude AI reviews each issue in context\n3. **False Positive Filtering** - AI identifies and removes non-issues\n4. **Dependency Checking** - Integrates with npm audit and CVE databases\n5. **Scoring** - Calculates weighted flaw score\n6. **Reporting** - Generates detailed, actionable reports\n\n## Tips for Achieving flaw 0\n\n1. **Fix Critical issues first** - Biggest security impact\n2. **Update dependencies** - Resolve known CVEs quickly\n3. **Use parameterized queries** - Prevent SQL injection\n4. **Validate all inputs** - Stop injection attacks\n5. **Use environment variables** - No hardcoded secrets\n6. **Apply security headers** - Use helmet.js\n7. **Implement authentication** - Protect all endpoints\n8. **Use strong crypto** - SHA-256 or better\n9. **Sanitize output** - Prevent XSS\n10. **Review AI suggestions** - Learn from recommendations\n\n## Comparison with Other Tools\n\n| Feature | flaw0 | npm audit | Snyk | ESLint Security |\n|---------|-------|-----------|------|-----------------|\n| Dependency CVEs | ✅ | ✅ | ✅ | ❌ |\n| AI Code Analysis | ✅ | ❌ | ❌ | ❌ |\n| OpenClaw-specific | ✅ | ❌ | ❌ | ❌ |\n| Context-aware | ✅ | ❌ | ⚠️ | ⚠️ |\n| False positive reduction | ✅ | ❌ | ⚠️ | ❌ |\n| Fix suggestions | ✅ | ⚠️ | ✅ | ⚠️ |\n\n## Requirements\n\n- **Node.js**: 14+\n- **API Key**: Anthropic API key for AI analysis\n- **npm**: For dependency checking\n\n### Setup API Key\n\n```bash\nexport ANTHROPIC_API_KEY='your-api-key-here'\n```\n\nGet your API key from: https:\u002F\u002Fconsole.anthropic.com\u002F\n\n## Troubleshooting\n\n### \"No API key found\"\n\n```bash\nexport ANTHROPIC_API_KEY='sk-...'\n# Or add to ~\u002F.bashrc or ~\u002F.zshrc\n```\n\n### \"npm audit failed\"\n\nEnsure you have a valid package.json:\n\n```bash\nnpm init -y\nnpm install\n```\n\n### Rate Limit Exceeded\n\nIf you hit API rate limits:\n1. Use haiku model: `--model haiku`\n2. Scan smaller portions\n3. Wait and retry\n\n## Support\n\n- **Documentation**: See USAGE.md for detailed guide\n- **Examples**: Check examples\u002F directory\n- **Issues**: Report at GitHub repository\n- **Demo**: Run `.\u002Fdemo.sh` for interactive demo\n\n## About\n\n**flaw0** helps the OpenClaw community achieve secure, vulnerability-free code.\n\n- Built with OpenClaw\u002FClaude AI\n- Uses industry-standard security patterns\n- Continuously updated with new vulnerabilities\n- Open source under MIT license\n\n## Contributing\n\nContributions welcome! Areas for contribution:\n- New vulnerability patterns\n- Additional AI models\n- Python\u002FGo support\n- Web dashboard\n- Custom rule engine\n\n## License\n\nMIT License - see LICENSE file\n\n---\n\n**Goal: flaw 0 for everyone! ?**\n\n**Remember**: Security is not a one-time check. Run flaw0 regularly to maintain **flaw 0** status!\n",{"name":5,"tags":47,"author":48,"license":14,"version":49,"homepage":50,"metadata":51,"description":7},[40,27,29,26,32],"Tom","1.0.0","https:\u002F\u002Fgithub.com\u002Fyourusername\u002Fflaw0",{"openclaw":52},{"emoji":53,"category":40},"?","main","f4cb2d49f7667e79ef7804f50396d5aaffdf1f56","安全与密码\u002Fflaw0",1,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification","https:\u002F\u002Fgithub.com\u002FKernel8901","a little little little dobe in life but science geek","2026-04-05 16:43:56",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add Kernel8901\u002Fai-agent-skills-classification --skill flaw0",{"tool":68,"command":69},"bunx","bunx skills add Kernel8901\u002Fai-agent-skills-classification --skill flaw0",{"tool":71,"command":72},"pnpm","pnpm dlx skills add Kernel8901\u002Fai-agent-skills-classification --skill flaw0","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F安全与密码\u002Fflaw0\u002FSKILL.md",true,[76],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"_meta.json","REFERENCE","参考文档",267,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F安全与密码\u002Fflaw0\u002F_meta.json",[83,107,139,150,160,187],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":42},"01M6Q5R6WZ06RRB9RQTW54B34B","zyfai","Earn yield on any Ethereum wallet on Base, Arbitrum, and Plasma. Use when a user wants passive DeFi yield on their funds. Deploys a non-custodial subaccount (Safe) linked to their EOA, enables automated yield optimization, and lets them deposit\u002Fwithdraw anytime.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzyfai-sdk\u002FSKILL.md",[],[85,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106],"safe","ethereum","defi","Optimization","user","use","Wallet","base","deposit","withdraw","yield","arbitrum","non-custodial","passive","defi yield","earn","yield optimization",{"skillNo":108,"name":109,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":121,"publishedAt":42},"01M6Q5R337B5JSNER4P4YS03TN","zerion-api","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api\u002FSKILL.md",[112,117,120],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":118,"categoryName":119,"taxonomyType":115,"taxonomyTypeDesc":116},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[122,123,124,125,126,127,128,92,129,96,130,131,132,133,134,135,136,137,138],"api","zerion api","zerion","MCP","mcp server","server","blockchain","transactions","crypto wallet","crypto","evm","solana","query","across","positions","token","prices",{"skillNo":140,"name":141,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":147,"publishedAt":42},"01M6Q5QZFYTDAZMZ27BN5VZXAR","zerion-api-skill","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-skill\u002FSKILL.md",[144,145,146],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":118,"categoryName":119,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[122,148,149,123,124,125,126,127,128,92,129,96,131,132,133,134,135,136,137,138],"api skill","zerion api skill",{"skillNo":151,"name":152,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":158,"publishedAt":42},"01M6Q5QW17QW98RA3FE45E4RD8","zerion-api-mcp","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-mcp\u002FSKILL.md",[155,156,157],{"categoryNo":113,"categoryName":114,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":118,"categoryName":119,"taxonomyType":115,"taxonomyTypeDesc":116},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[125,122,159,123,124,126,127,92,129,96,130,131,132,133,134,135,136,137,138],"zerion api mcp",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":169,"publishedAt":42},"01M6Q5QQYZB7A501BDEQWKGSJT","yahoo-finance-forex","Fetches real-time FOREX news and market data from Yahoo Finance for major currency pairs (EUR\u002FUSD, GBP\u002FUSD, USD\u002FJPY, etc.). Analyzes sentiment and provides trading context.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-forex\u002FSKILL.md",[166],{"categoryNo":167,"categoryName":168,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000040","财务",[170,171,172,173,174,41,38,175,176,177,178,179,180,181,182,183,184,185,186,24],"finance","yahoo finance","forex","yahoo","yahoo finance forex","sentiment","real-time","python3","install","Market","usd","news","time","currency","gbp","pip","market data",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":42},"01M6Q5QM6VS84WZVM7BKXXPF32","yahoo-finance","This skill should be used when the user asks to \"get stock prices\", \"check stock quotes\", \"look up earnings\", \"get financial data\", \"find trending stocks\", or needs stock market data from Yahoo Finance.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-cli\u002FSKILL.md",[193],{"categoryNo":167,"categoryName":168,"taxonomyType":20,"taxonomyTypeDesc":21},[170,171,173,195,196,197,198,199,200,179,201,202,203,204,205,206,207,208,138,186],"cli","homebrew","find","check","brew","up","local","get","stock","link","trending","sf","quotes","ln"]