🦒 Giraffe Guard — 长颈鹿卫士

🦒 Giraffe Guard — 长颈鹿卫士

Scan OpenClaw skill directories for supply chain attacks and malicious code. 扫描 OpenClaw skill 目录，检测潜在的供应链投毒和恶意代码。

Features / 功能

22 security detection rules covering the full supply chain attack surface / 22 条检测规则，覆盖供应链攻击全链路

Context-aware: distinguishes documentation from executable code, reducing false positives / 上下文感知：区分文档描述和实际可执行代码，降低误报

Colored terminal output + JSON report output / 彩色终端输出 + JSON 格式报告

--verbose mode shows matching line context / --verbose 模式显示匹配行上下文

--skip-dir to exclude directories / --skip-dir 跳过指定目录

Whitelist support / 白名单机制

Compatible with macOS and Linux, zero external dependencies / 兼容 macOS 和 Linux，零外部依赖

Usage / 使用方法

Scan a skill directory / 扫描目录

{baseDir}/scripts/audit.sh /path/to/skills

Verbose mode / 详细模式

{baseDir}/scripts/audit.sh --verbose /path/to/skills

JSON report / JSON 报告

{baseDir}/scripts/audit.sh --json /path/to/skills

With whitelist / 使用白名单

{baseDir}/scripts/audit.sh --whitelist whitelist.txt /path/to/skills

Skip directories / 跳过目录

{baseDir}/scripts/audit.sh --skip-dir node_modules --skip-dir vendor /path/to/skills

Combined / 组合使用

{baseDir}/scripts/audit.sh --verbose --context 3 --whitelist whitelist.txt --skip-dir node_modules /path/to/skills

Detection Rules (22) / 检测规则

🔴 Critical / 严重级别

| # | Rule | EN | 中文 | |---|------|----|------| | 1 | pipe-execution | Pipe execution (curl/wget to bash) | 管道执行 | | 2 | base64-decode-pipe | Base64 decoded and piped | Base64 解码管道执行 | | 3 | security-bypass | macOS Gatekeeper/SIP bypass | 安全机制绕过 | | 5 | tor-onion-address | Tor hidden service | 暗网地址 | | 5 | reverse-shell | Reverse shell patterns | 反向 shell | | 7 | file-type-disguise | Binary disguised as text | 文件类型伪装 | | 8 | ssh-key-exfiltration | SSH key theft | SSH 密钥窃取 | | 8 | cloud-credential-access | Cloud credential access | 云凭证访问 | | 8 | env-exfiltration | Env vars sent over network | 环境变量外传 | | 9 | anti-sandbox | Anti-debug/anti-sandbox | 反沙盒/反调试 | | 10 | covert-downloader | One-liner downloaders | 单行下载器 | | 11 | persistence-launchagent | macOS LaunchAgent | 持久化 | | 13 | string-concat-bypass | String concatenation bypass | 字符串拼接绕过 | | 15 | env-file-leak | .env with real secrets | .env 密钥泄露 | | 16 | typosquat-npm/pip | Typosquatting packages | 包名仿冒 | | 17 | malicious-postinstall | Malicious lifecycle scripts | 恶意生命周期脚本 | | 18 | git-hooks | Active git hooks | 活跃 git hooks | | 19 | sensitive-file-leak | Private keys/credentials | 私钥/凭证泄露 | | 20 | skillmd-prompt-injection | Prompt injection in SKILL.md | SKILL.md prompt 注入 | | 21 | dockerfile-privileged | Docker privileged mode | Docker 特权模式 | | 22 | zero-width-chars | Zero-width Unicode chars | 零宽 Unicode 字符 |

🟡 Warning / 警告级别

| # | Rule | EN | 中文 | |---|------|----|------| | 2 | long-base64-string | Long Base64 strings | 超长 Base64 字符串 | | 4 | dangerous-permissions | Dangerous permissions | 危险权限修改 | | 5 | suspicious-network-ip | Non-local IP connections | 非本地 IP 直连 | | 5 | netcat-listener | Netcat listeners | netcat 监听 | | 6 | covert-exec-eval | Suspicious eval() (JS/TS) | 可疑 eval 调用 | | 6 | covert-exec-python | os.system/subprocess in .py | Python 危险调用 | | 11 | cron-injection | Cron/launchctl injection | 定时任务注入 | | 12 | hidden-executable | Hidden executable files | 隐藏可执行文件 | | 13 | hex/unicode-obfuscation | Hex/Unicode obfuscation | hex/Unicode 混淆 | | 14 | symlink-sensitive | Symlinks to sensitive paths | 敏感符号链接 | | 16 | custom-registry | Non-official registries | 非官方包源 | | 20 | skillmd-privilege-escalation | Privilege escalation | 权限提升 | | 21 | dockerfile-sensitive-mount | Sensitive mounts | 敏感目录挂载 | | 21 | dockerfile-host-network | Host network mode | 主机网络模式 |

Exit Codes / 退出码

0 — ✅ Clean / 安全

1 — 🟡 Warnings / 有警告

2 — 🔴 Critical / 有严重发现

Dependencies / 依赖

No external dependencies. Uses: bash, grep, sed, find, file, awk, readlink, perl 零外部依赖，仅使用系统自带工具。