[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6Q4WD6RD0BZJSWWYARAP0R0":3,"skill-same:01M6Q4WD6RD0BZJSWWYARAP0R0":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6Q4WD6RD0BZJSWWYARAP0R0","security-scanner",null,"Comprehensive vulnerability and malware scanner for skills and code. Detects code execution vulnerabilities (eval, exec, dynamic require), credential theft patterns, network calls to suspicious domains, obfuscation, and more. Provides risk assessment (SAFE\u002FCAUTION\u002FDANGEROUS) with detailed findings and actionable recommendations. Use before installing untrusted skills or when reviewing code for security issues.","Kernel8901\u002Fai-agent-skills-classification","Kernel8901","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F72647553?v=4","01M6KV388J2H5PNC8D8P940BJD","01M6KV38CS5B3AY63RKZB410YM",7,"MIT","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"security","scanner","security scanner","risk","for","actionable","code execution","domains","recommendations","patterns","eval","vulnerability","network","malware","issues","code","assessment","risk assessment","safe","suspicious","2026-11-10 10:12:30",false,"---\nname: security-scanner\ndescription: Comprehensive vulnerability and malware scanner for skills and code. Detects code execution vulnerabilities (eval, exec, dynamic require), credential theft patterns, network calls to suspicious domains, obfuscation, and more. Provides risk assessment (SAFE\u002FCAUTION\u002FDANGEROUS) with detailed findings and actionable recommendations. Use before installing untrusted skills or when reviewing code for security issues.\n---\n\n# Security Scanner Skill\n\nComprehensive static analysis tool for detecting vulnerabilities, malware patterns, and security issues in code and skills.\n\n## Overview\n\nSecurity Scanner performs deep static analysis on:\n- **Code files** (.js, .ts, .jsx, .tsx, .py, .go, .java, .rb, .php, .sh)\n- **Skill directories** (recursively scans all code)\n- **Inline code snippets**\n\nIt flags dangerous patterns, suspicious behaviors, and obfuscation, then provides actionable recommendations.\n\n## Quick Start\n\n```bash\n# Scan a skill directory\nsecurity-scanner .\u002Fmy-skill\u002F\n\n# Scan a single file\nsecurity-scanner .\u002Fpackage.js\n\n# Scan code snippet\nsecurity-scanner --code \"eval(userInput)\"\n\n# Get JSON output\nsecurity-scanner .\u002Fskill --output json\n\n# See suggested fixes\nsecurity-scanner .\u002Fskill --fix\n```\n\n## Risk Levels & Recommendations\n\n### ? DANGEROUS → REJECT\n**Verdict:** Do not install this code.\n\nDetected patterns:\n- `eval()` - Arbitrary code execution\n- `exec()` - Command execution\n- Dynamic `require()` with variable paths\n- Evidence of code injection vulnerabilities\n\n**Action:** Request source code review from maintainer or reject entirely.\n\n### ? CAUTION → QUARANTINE\n**Verdict:** Review before installation.\n\nDetected patterns:\n- `child_process` calls (spawning external commands)\n- Environment variable access (potential secret theft)\n- Network calls to unknown domains\n- Obfuscated\u002Fminified code\n- Low-level socket access (net, dgram)\n- Encoded strings (hex\u002FUnicode escapes)\n\n**Action:** Examine findings, ask maintainer about suspicious patterns, install with caution.\n\n### ? SAFE → INSTALL\n**Verdict:** No obvious malicious patterns detected.\n\n**Action:** Safe to install. Standard security practices still recommended (keep updated, monitor permissions).\n\n## What It Detects\n\n### Code Execution (Highest Risk)\n- ✗ `eval()`\n- ✗ `exec()`\n- ✗ Dynamic `require()` with variable paths\n- ⚠ `child_process` module imports\n\n### Credential Theft\n- ✗ `process.env.SECRET`, `process.env.API_KEY`, etc.\n- ⚠ Dynamic environment variable access `process.env[varName]`\n- ⚠ `fs.readFileSync()` on sensitive system files (`\u002Fetc\u002F`, `~\u002F`)\n\n### Network\u002FData Exfiltration\n- ⚠ Network calls to unknown external domains (via `fetch`, `http.get`, etc.)\n- ⚠ HTTP\u002FHTTPS module imports (potential network calls)\n- ⚠ Low-level socket access (`net`, `dgram`)\n\n### Obfuscation (Red Flag)\n- ⚠ Minified code (unusually high symbol density, very short lines)\n- ⚠ Hex-encoded strings (`\\x41\\x42\\x43`)\n- ⚠ Unicode-encoded strings (`\\u0041\\u0042`)\n\n**Why it matters:** Obfuscated code hides malicious logic. Legitimate libraries don't need to be obfuscated.\n\n## Output Formats\n\n### Text (Human-Readable, Default)\n\n```\n=== Security Scanner Report ===\n\nTarget: .\u002Fmy-skill\nFiles Scanned: 5\nFindings: 2\n\nRisk Level: CAUTION\n\nDetailed Findings:\n\n  scripts\u002Fhandler.js\n    Line 42: [CAUTION] child_process allows spawning external commands\n      Code: require('child_process')\n      Context: const spawn = require('child_process').spawn;\n\n  src\u002Fapi.js\n    Line 18: [CAUTION] Network call to external domain\n      Code: fetch('https:\u002F\u002Fapi.example.com\u002Fverify')\n      Context: return fetch('https:\u002F\u002Fapi.example.com\u002Fverify', {...})\n\nRecommendation:\n  Action: QUARANTINE\n  Reason: Code contains potentially suspicious patterns requiring review\n  Details: Review findings before installation. Consider asking maintainer about specific suspicious patterns.\n\nSuggested Fixes:\n  • Replace dynamic require with static import\n    File: scripts\u002Fhandler.js:42\n    Suggestion: Use static imports or a whitelist of allowed modules\n    Difficulty: MEDIUM\n```\n\n### JSON (Programmatic)\n\n```bash\nscanner --output json\n```\n\nReturns structured JSON with:\n- `target`: Path\u002Fname scanned\n- `timestamp`: ISO timestamp\n- `riskLevel`: SAFE | CAUTION | DANGEROUS\n- `findings[]`: Array of detected issues with line numbers\n- `scannedFiles[]`: List of files analyzed\n- `recommendation`: Action and reasoning\n- `fixes[]`: (if `--fix` used) Suggested code changes\n\n## Using It in Your Workflow\n\n### Pre-Installation Check\n\n```bash\n# Before installing a new skill\nsecurity-scanner ~\u002Fdownloads\u002Fmystery-skill\u002F\n\n# If DANGEROUS → Don't install\n# If CAUTION → Review output, ask author\n# If SAFE → Good to go\n```\n\n### Code Review\n\n```bash\n# Check your own skill for issues\nsecurity-scanner .\u002Fmy-skill\u002F --output json > security-report.json\n\n# Fix issues\nsecurity-scanner .\u002Fmy-skill\u002F --fix\n```\n\n### Automated CI\u002FCD\n\n```bash\n# In your build pipeline - fail if DANGEROUS detected\nsecurity-scanner .\u002Fsrc\u002F --output json\nif [ $? -eq 2 ]; then\n  echo \"Security violations found\"\n  exit 1\nfi\n```\n\n### Sub-Agent Invocation\n\n```bash\n# From a sub-agent or CLI\n\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js ~\u002Fclawd\u002Fsome-skill\u002F\n```\n\n## Common Findings & How to Interpret\n\n### eval() \u002F exec()\n**Finding:** \"eval() allows arbitrary code execution\"\n\n**Interpretation:** Code can run any arbitrary JavaScript at runtime. Extremely dangerous.\n\n**Response:** \n- ❌ If malicious: REJECT\n- ⚠️ If legitimate: Ask author why eval is needed (usually there's a safer way)\n\n### child_process Import\n**Finding:** \"child_process allows spawning external commands\"\n\n**Interpretation:** Code can run system commands. Used legitimately by build tools, but also by malware.\n\n**Response:**\n- Check where it's used\n- Does it run user input? → DANGEROUS\n- Does it run hardcoded commands? → Probably safe, but review\n\n### process.env.API_KEY\n**Finding:** \"Accessing sensitive environment variables\"\n\n**Interpretation:** Code reads secret keys from environment. This is standard, but verify:\n- Is it documented?\n- Is the key actually used for intended purpose?\n- Could it be exfiltrated?\n\n**Response:**\n- Normal for legitimate skills that need API keys\n- Check if the API call goes to the expected domain\n\n### Minified Code\n**Finding:** \"Code appears to be minified or obfuscated\"\n\n**Interpretation:** Source code is intentionally hidden. Why?\n\n**Response:**\n- ❌ Single-file skill that's minified → Suspicious, ask for source\n- ✅ Node module with both `.js` and `.min.js` → Standard practice\n- ⚠️ Hex-encoded strings → Request deobfuscation\n\n### Fetch to Unknown Domain\n**Finding:** \"Network call to external domain\"\n\n**Interpretation:** Code calls some external API. Is it expected?\n\n**Response:**\n- ✅ `fetch('https:\u002F\u002Fapi.github.com\u002F...')` → Normal\n- ❌ `fetch('https:\u002F\u002Fmalware-collection.ru\u002F...')` → Dangerous\n- ⚠️ `fetch(userProvidedUrl)` → Dangerous (open redirect)\n\n## How to Use with Sub-Agents\n\nFrom a sub-agent, invoke the scanner:\n\n```bash\n# Run scan\n\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js \u003Cskill-path>\n\n# Check exit code\nif [ $? -eq 2 ]; then\n  # DANGEROUS - handle rejection\nelif [ $? -eq 1 ]; then\n  # CAUTION - handle quarantine\nelse\n  # SAFE\nfi\n\n# Or parse JSON output\nresult=$(\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js \u003Cpath> --output json)\nriskLevel=$(echo \"$result\" | jq -r '.riskLevel')\n```\n\n## Limitations\n\n⚠️ **Static analysis only** - Does not execute code, so:\n- Runtime tricks might not be detected\n- Obfuscated strings that are decoded at runtime won't be flagged\n- Complex control flow analysis not performed\n\n**Still safe:** Unless the scanner says DANGEROUS, you should be fine. CAUTION requires manual review but many are false positives.\n\n## Commands\n\n### `security-scanner \u003Cpath>`\nScan a file or directory.\n\n```bash\nsecurity-scanner .\u002Fmy-skill\u002F\nsecurity-scanner .\u002Fcode.js\n```\n\n### `security-scanner --code \"\u003Csnippet>\"`\nScan inline code without creating a file.\n\n```bash\nsecurity-scanner --code \"eval(userInput)\"\n```\n\n### `security-scanner \u003Cpath> --output json`\nOutput results as JSON for programmatic parsing.\n\n```bash\nsecurity-scanner .\u002Fskill --output json > report.json\n```\n\n### `security-scanner \u003Cpath> --output text`\nOutput as human-readable text (default).\n\n### `security-scanner \u003Cpath> --fix`\nShow suggested code fixes and mitigation strategies.\n\n```bash\nsecurity-scanner .\u002Fskill --fix\n```\n\n### `security-scanner --help`\nShow usage information.\n\n## Exit Codes\n\n- `0` - SAFE (no dangerous patterns)\n- `1` - CAUTION (suspicious patterns found, manual review needed)\n- `2` - DANGEROUS (malicious patterns detected, do not install)\n\n## Implementation Notes\n\n- Pattern matching via regular expressions\n- Obfuscation detection via heuristics (symbol density, encoding)\n- Line-accurate reporting (can pinpoint exact locations)\n- Multi-language support (.js, .ts, .py, .go, .java, .rb, .php, .sh)\n- Automatic filtering of non-code directories (node_modules, .git, dist, etc.)\n\n## Future Enhancements\n\nPotential additions:\n- Semantic analysis (understand variable data flow)\n- Signature-based detection (known malware patterns)\n- Configuration audit (unusual permissions, suspicious settings)\n- Quarantine mode (automatically remove\u002Fcomment suspicious code)\n- Integration with malware databases\n- Supply chain attack detection (pinning specific versions, checksum verification)\n\n---\n\n**Last Updated:** 2025-01-29\n**Status:** Production Ready\n","# Security Scanner Skill\n\nComprehensive static analysis tool for detecting vulnerabilities, malware patterns, and security issues in code and skills.\n\n## Overview\n\nSecurity Scanner performs deep static analysis on:\n- **Code files** (.js, .ts, .jsx, .tsx, .py, .go, .java, .rb, .php, .sh)\n- **Skill directories** (recursively scans all code)\n- **Inline code snippets**\n\nIt flags dangerous patterns, suspicious behaviors, and obfuscation, then provides actionable recommendations.\n\n## Quick Start\n\n```bash\n# Scan a skill directory\nsecurity-scanner .\u002Fmy-skill\u002F\n\n# Scan a single file\nsecurity-scanner .\u002Fpackage.js\n\n# Scan code snippet\nsecurity-scanner --code \"eval(userInput)\"\n\n# Get JSON output\nsecurity-scanner .\u002Fskill --output json\n\n# See suggested fixes\nsecurity-scanner .\u002Fskill --fix\n```\n\n## Risk Levels & Recommendations\n\n### ? DANGEROUS → REJECT\n**Verdict:** Do not install this code.\n\nDetected patterns:\n- `eval()` - Arbitrary code execution\n- `exec()` - Command execution\n- Dynamic `require()` with variable paths\n- Evidence of code injection vulnerabilities\n\n**Action:** Request source code review from maintainer or reject entirely.\n\n### ? CAUTION → QUARANTINE\n**Verdict:** Review before installation.\n\nDetected patterns:\n- `child_process` calls (spawning external commands)\n- Environment variable access (potential secret theft)\n- Network calls to unknown domains\n- Obfuscated\u002Fminified code\n- Low-level socket access (net, dgram)\n- Encoded strings (hex\u002FUnicode escapes)\n\n**Action:** Examine findings, ask maintainer about suspicious patterns, install with caution.\n\n### ? SAFE → INSTALL\n**Verdict:** No obvious malicious patterns detected.\n\n**Action:** Safe to install. Standard security practices still recommended (keep updated, monitor permissions).\n\n## What It Detects\n\n### Code Execution (Highest Risk)\n- ✗ `eval()`\n- ✗ `exec()`\n- ✗ Dynamic `require()` with variable paths\n- ⚠ `child_process` module imports\n\n### Credential Theft\n- ✗ `process.env.SECRET`, `process.env.API_KEY`, etc.\n- ⚠ Dynamic environment variable access `process.env[varName]`\n- ⚠ `fs.readFileSync()` on sensitive system files (`\u002Fetc\u002F`, `~\u002F`)\n\n### Network\u002FData Exfiltration\n- ⚠ Network calls to unknown external domains (via `fetch`, `http.get`, etc.)\n- ⚠ HTTP\u002FHTTPS module imports (potential network calls)\n- ⚠ Low-level socket access (`net`, `dgram`)\n\n### Obfuscation (Red Flag)\n- ⚠ Minified code (unusually high symbol density, very short lines)\n- ⚠ Hex-encoded strings (`\\x41\\x42\\x43`)\n- ⚠ Unicode-encoded strings (`\\u0041\\u0042`)\n\n**Why it matters:** Obfuscated code hides malicious logic. Legitimate libraries don't need to be obfuscated.\n\n## Output Formats\n\n### Text (Human-Readable, Default)\n\n```\n=== Security Scanner Report ===\n\nTarget: .\u002Fmy-skill\nFiles Scanned: 5\nFindings: 2\n\nRisk Level: CAUTION\n\nDetailed Findings:\n\n  scripts\u002Fhandler.js\n    Line 42: [CAUTION] child_process allows spawning external commands\n      Code: require('child_process')\n      Context: const spawn = require('child_process').spawn;\n\n  src\u002Fapi.js\n    Line 18: [CAUTION] Network call to external domain\n      Code: fetch('https:\u002F\u002Fapi.example.com\u002Fverify')\n      Context: return fetch('https:\u002F\u002Fapi.example.com\u002Fverify', {...})\n\nRecommendation:\n  Action: QUARANTINE\n  Reason: Code contains potentially suspicious patterns requiring review\n  Details: Review findings before installation. Consider asking maintainer about specific suspicious patterns.\n\nSuggested Fixes:\n  • Replace dynamic require with static import\n    File: scripts\u002Fhandler.js:42\n    Suggestion: Use static imports or a whitelist of allowed modules\n    Difficulty: MEDIUM\n```\n\n### JSON (Programmatic)\n\n```bash\nscanner --output json\n```\n\nReturns structured JSON with:\n- `target`: Path\u002Fname scanned\n- `timestamp`: ISO timestamp\n- `riskLevel`: SAFE | CAUTION | DANGEROUS\n- `findings[]`: Array of detected issues with line numbers\n- `scannedFiles[]`: List of files analyzed\n- `recommendation`: Action and reasoning\n- `fixes[]`: (if `--fix` used) Suggested code changes\n\n## Using It in Your Workflow\n\n### Pre-Installation Check\n\n```bash\n# Before installing a new skill\nsecurity-scanner ~\u002Fdownloads\u002Fmystery-skill\u002F\n\n# If DANGEROUS → Don't install\n# If CAUTION → Review output, ask author\n# If SAFE → Good to go\n```\n\n### Code Review\n\n```bash\n# Check your own skill for issues\nsecurity-scanner .\u002Fmy-skill\u002F --output json > security-report.json\n\n# Fix issues\nsecurity-scanner .\u002Fmy-skill\u002F --fix\n```\n\n### Automated CI\u002FCD\n\n```bash\n# In your build pipeline - fail if DANGEROUS detected\nsecurity-scanner .\u002Fsrc\u002F --output json\nif [ $? -eq 2 ]; then\n  echo \"Security violations found\"\n  exit 1\nfi\n```\n\n### Sub-Agent Invocation\n\n```bash\n# From a sub-agent or CLI\n\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js ~\u002Fclawd\u002Fsome-skill\u002F\n```\n\n## Common Findings & How to Interpret\n\n### eval() \u002F exec()\n**Finding:** \"eval() allows arbitrary code execution\"\n\n**Interpretation:** Code can run any arbitrary JavaScript at runtime. Extremely dangerous.\n\n**Response:** \n- ❌ If malicious: REJECT\n- ⚠️ If legitimate: Ask author why eval is needed (usually there's a safer way)\n\n### child_process Import\n**Finding:** \"child_process allows spawning external commands\"\n\n**Interpretation:** Code can run system commands. Used legitimately by build tools, but also by malware.\n\n**Response:**\n- Check where it's used\n- Does it run user input? → DANGEROUS\n- Does it run hardcoded commands? → Probably safe, but review\n\n### process.env.API_KEY\n**Finding:** \"Accessing sensitive environment variables\"\n\n**Interpretation:** Code reads secret keys from environment. This is standard, but verify:\n- Is it documented?\n- Is the key actually used for intended purpose?\n- Could it be exfiltrated?\n\n**Response:**\n- Normal for legitimate skills that need API keys\n- Check if the API call goes to the expected domain\n\n### Minified Code\n**Finding:** \"Code appears to be minified or obfuscated\"\n\n**Interpretation:** Source code is intentionally hidden. Why?\n\n**Response:**\n- ❌ Single-file skill that's minified → Suspicious, ask for source\n- ✅ Node module with both `.js` and `.min.js` → Standard practice\n- ⚠️ Hex-encoded strings → Request deobfuscation\n\n### Fetch to Unknown Domain\n**Finding:** \"Network call to external domain\"\n\n**Interpretation:** Code calls some external API. Is it expected?\n\n**Response:**\n- ✅ `fetch('https:\u002F\u002Fapi.github.com\u002F...')` → Normal\n- ❌ `fetch('https:\u002F\u002Fmalware-collection.ru\u002F...')` → Dangerous\n- ⚠️ `fetch(userProvidedUrl)` → Dangerous (open redirect)\n\n## How to Use with Sub-Agents\n\nFrom a sub-agent, invoke the scanner:\n\n```bash\n# Run scan\n\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js \u003Cskill-path>\n\n# Check exit code\nif [ $? -eq 2 ]; then\n  # DANGEROUS - handle rejection\nelif [ $? -eq 1 ]; then\n  # CAUTION - handle quarantine\nelse\n  # SAFE\nfi\n\n# Or parse JSON output\nresult=$(\u002FUsers\u002Fericwoodard\u002Fclawd\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js \u003Cpath> --output json)\nriskLevel=$(echo \"$result\" | jq -r '.riskLevel')\n```\n\n## Limitations\n\n⚠️ **Static analysis only** - Does not execute code, so:\n- Runtime tricks might not be detected\n- Obfuscated strings that are decoded at runtime won't be flagged\n- Complex control flow analysis not performed\n\n**Still safe:** Unless the scanner says DANGEROUS, you should be fine. CAUTION requires manual review but many are false positives.\n\n## Commands\n\n### `security-scanner \u003Cpath>`\nScan a file or directory.\n\n```bash\nsecurity-scanner .\u002Fmy-skill\u002F\nsecurity-scanner .\u002Fcode.js\n```\n\n### `security-scanner --code \"\u003Csnippet>\"`\nScan inline code without creating a file.\n\n```bash\nsecurity-scanner --code \"eval(userInput)\"\n```\n\n### `security-scanner \u003Cpath> --output json`\nOutput results as JSON for programmatic parsing.\n\n```bash\nsecurity-scanner .\u002Fskill --output json > report.json\n```\n\n### `security-scanner \u003Cpath> --output text`\nOutput as human-readable text (default).\n\n### `security-scanner \u003Cpath> --fix`\nShow suggested code fixes and mitigation strategies.\n\n```bash\nsecurity-scanner .\u002Fskill --fix\n```\n\n### `security-scanner --help`\nShow usage information.\n\n## Exit Codes\n\n- `0` - SAFE (no dangerous patterns)\n- `1` - CAUTION (suspicious patterns found, manual review needed)\n- `2` - DANGEROUS (malicious patterns detected, do not install)\n\n## Implementation Notes\n\n- Pattern matching via regular expressions\n- Obfuscation detection via heuristics (symbol density, encoding)\n- Line-accurate reporting (can pinpoint exact locations)\n- Multi-language support (.js, .ts, .py, .go, .java, .rb, .php, .sh)\n- Automatic filtering of non-code directories (node_modules, .git, dist, etc.)\n\n## Future Enhancements\n\nPotential additions:\n- Semantic analysis (understand variable data flow)\n- Signature-based detection (known malware patterns)\n- Configuration audit (unusual permissions, suspicious settings)\n- Quarantine mode (automatically remove\u002Fcomment suspicious code)\n- Integration with malware databases\n- Supply chain attack detection (pinning specific versions, checksum verification)\n\n---\n\n**Last Updated:** 2025-01-29\n**Status:** Production Ready\n",{"name":5,"description":7},"main","f4cb2d49f7667e79ef7804f50396d5aaffdf1f56","语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill",1,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification","https:\u002F\u002Fgithub.com\u002FKernel8901","a little little little dobe in life but science geek","2026-04-05 16:43:56",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add Kernel8901\u002Fai-agent-skills-classification --skill security-scanner",{"tool":67,"command":68},"bunx","bunx skills add Kernel8901\u002Fai-agent-skills-classification --skill security-scanner",{"tool":70,"command":71},"pnpm","pnpm dlx skills add Kernel8901\u002Fai-agent-skills-classification --skill security-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002FSKILL.md",true,[75,81,85,89,93,99,103,107],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"cli.sh","SCRIPT","脚本",266,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fcli.sh",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"examples\u002Fexample-caution.js",1136,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fexamples\u002Fexample-caution.js",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"examples\u002Fexample-dangerous.js",862,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fexamples\u002Fexample-dangerous.js",{"path":90,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":91,"sourceHtmlUrl":92},"examples\u002Fexample-safe.js",885,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fexamples\u002Fexample-safe.js",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"package.json","REFERENCE","参考文档",691,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fpackage.json",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"README.md",11213,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002FREADME.md",{"path":104,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fscanner.js",15151,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Fscripts\u002Fscanner.js",{"path":108,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":109,"sourceHtmlUrl":110},"test.sh",1563,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F语音与转录\u002Fvoice-devotional\u002Fsecurity-scanner-skill\u002Ftest.sh",[112,135,163,174,184,213],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":48},"01M6Q5R6WZ06RRB9RQTW54B34B","zyfai","Earn yield on any Ethereum wallet on Base, Arbitrum, and Plasma. Use when a user wants passive DeFi yield on their funds. Deploys a non-custodial subaccount (Safe) linked to their EOA, enables automated yield optimization, and lets them deposit\u002Fwithdraw anytime.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzyfai-sdk\u002FSKILL.md",[],[114,46,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134],"ethereum","defi","Optimization","user","use","Wallet","base","deposit","withdraw","yield","arbitrum","non-custodial","passive","defi yield","earn","yield optimization",{"skillNo":136,"name":137,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":145,"publishedAt":48},"01M6Q5R337B5JSNER4P4YS03TN","zerion-api","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api\u002FSKILL.md",[140,143,144],{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[146,147,148,149,150,151,152,120,153,124,154,155,156,157,158,159,160,161,162],"api","zerion api","zerion","MCP","mcp server","server","blockchain","transactions","crypto wallet","crypto","evm","solana","query","across","positions","token","prices",{"skillNo":164,"name":165,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":171,"publishedAt":48},"01M6Q5QZFYTDAZMZ27BN5VZXAR","zerion-api-skill","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-skill\u002FSKILL.md",[168,169,170],{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[146,172,173,147,148,149,150,151,152,120,153,124,155,156,157,158,159,160,161,162],"api skill","zerion api skill",{"skillNo":175,"name":176,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":182,"publishedAt":48},"01M6Q5QW17QW98RA3FE45E4RD8","zerion-api-mcp","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-mcp\u002FSKILL.md",[179,180,181],{"categoryNo":141,"categoryName":142,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[149,146,183,147,148,150,151,120,153,124,154,155,156,157,158,159,160,161,162],"zerion api mcp",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":193,"publishedAt":48},"01M6Q5QQYZB7A501BDEQWKGSJT","yahoo-finance-forex","Fetches real-time FOREX news and market data from Yahoo Finance for major currency pairs (EUR\u002FUSD, GBP\u002FUSD, USD\u002FJPY, etc.). Analyzes sentiment and provides trading context.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-forex\u002FSKILL.md",[190],{"categoryNo":191,"categoryName":192,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000040","财务",[194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,32],"finance","yahoo finance","forex","yahoo","yahoo finance forex","github","https","sentiment","real-time","python3","install","Market","usd","news","time","currency","gbp","pip","market data",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":48},"01M6Q5QM6VS84WZVM7BKXXPF32","yahoo-finance","This skill should be used when the user asks to \"get stock prices\", \"check stock quotes\", \"look up earnings\", \"get financial data\", \"find trending stocks\", or needs stock market data from Yahoo Finance.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-cli\u002FSKILL.md",[219],{"categoryNo":191,"categoryName":192,"taxonomyType":25,"taxonomyTypeDesc":26},[194,195,197,221,222,223,224,225,226,205,227,228,229,230,231,232,233,234,162,212],"cli","homebrew","find","check","brew","up","local","get","stock","link","trending","sf","quotes","ln"]