https://clawhub.ai/api/v1/skills/auto-deploy/file?path=SKILL.md&version=1.0.0
github.com/clawhub.ai/auto-deploy
Scanned Thu, 28 May 2026 17:03:14 GMT
Scan ID crawl-nf3rrw0xylej48yewxjv4gob · 1ms
C
SCORE 55 / 100
Verdict: Proceed with caution

9 high-severity findings.

This skill reads protected filesystem locations plus 9 other issues listed below.

0 critical9 high1 medium2 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 9 high-severity findings (3+ HIGHs → C).

0 CRIT9 HIGH1 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 7 of 9 HIGH (cap is 2).

  • A
    Reach Atarget score 95

    Resolve all 9 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 25CWE-552
▾
23```bash
24# 生成 SSH Key
25ssh-keygen -t ed25519 -C "openclaw-deploy" -f ~/.ssh/openclaw_deploy← sensitive path — credential-exfiltration vector
26
27# 将公钥添加到 Git 服务器
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 28CWE-552
▾
26
27# 将公钥添加到 Git 服务器
28cat ~/.ssh/openclaw_deploy.pub← sensitive path — credential-exfiltration vector
29```
30
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 35CWE-552
▾
33```bash
34# 生成部署 SSH Key（如果复用上面的可以跳过）
35ssh-keygen -t ed25519 -C "server-deploy" -f ~/.ssh/server_deploy← sensitive path — credential-exfiltration vector
36
37# 将公钥添加到服务器
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 38CWE-552
▾
36
37# 将公钥添加到服务器
38ssh-copy-id -i ~/.ssh/server_deploy.pub user@server_ip← sensitive path — credential-exfiltration vector
39```
40
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 48CWE-552
▾
46
47# 测试服务器连接
48ssh -i ~/.ssh/server_deploy user@server_ip "echo connected"← sensitive path — credential-exfiltration vector
49```
50
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 101CWE-552
▾
99#### 步骤 6：SSH 传输到服务器
100```bash
101scp -i ~/.ssh/server_deploy points-deploy.tar.gz user@server:/tmp/← sensitive path — credential-exfiltration vector
102```
103
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 106CWE-552
▾
104#### 步骤 7：服务器部署
105```bash
106ssh -i ~/.ssh/server_deploy user@server << 'EOF'← sensitive path — credential-exfiltration vector
107 # 备份当前版本
108 cp -r /www/wwwroot/points /www/backup/points_$(date +%Y%m%d_%H%M%S)
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 130CWE-552
▾
128#### 步骤 8：健康检查
129```bash
130ssh -i ~/.ssh/server_deploy user@server "curl -s http://localhost:端口/health || exit 1"← sensitive path — credential-exfiltration vector
131```
132
high
Sensitive filesystem path referenced
The skill references a path (`~\/\.ssh\/`) that contains credentials or system secrets. Reading this from an unsandboxed skill is a credential-exfiltration vector.
rule: filesystem-overreachline: 159CWE-552
▾
157### SSH 连接失败
158- 检查服务器 SSH 服务状态
159- 验证 SSH Key 权限（`chmod 600 ~/.ssh/server_deploy`）← sensitive path — credential-exfiltration vector
160- 确认防火墙放行 SSH 端口
161
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-nf3rrw0xylej48yewxjv4gob