Menu

Individual skill

openclaw-threat-detect

0upvotes

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

skills/openclaw-threat-detect/SKILL.md

Read pinned source

Source commit 12234a11a9d96acef85577afb1fa5682169d6171

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Network or broad shell
Last checked
Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
318
Repository last updated
Oct 20, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# OpenClaw 攻击模式检测器

基于《OpenClaw 极简安全实践指南》红线规则和 MITRE ATT&CK 框架，对命令、文件、网络流量进行实时和离线威胁检测。覆盖 AI Agent 场景下特有的攻击面——不仅检测传统 shell 攻击，还识别通过 Prompt 注入触发的间接恶意行为。

## Purpose

OpenClaw Agent 具有命令执行、文件读写、网络请求等能力。当 Agent 被恶意 Prompt 注入或加载了被投毒的 Skill 时，可能执行数据外传、反弹 Shell、凭证窃取等高危操作。本技能提供多层检测能力，覆盖从命令级到行为链级的威胁识别。

## Prerequisites

### Authorization Requirements
- OpenClaw 实例的日志访问权限
- 命令历史和文件系统读取权限
- 网络流量监控权限（如需实时检测）
Back to top