🎉 init: 小龙的工作空间

skills/security-check.md

@@ -0,0 +1,56 @@
+---
+name: security-check
+description: Pre-execution risk assessment for tool calls. Checks file sensitivity, blast radius, irreversibility before running dangerous commands.
+metadata: { "openclaw": { "emoji": "🛡️" } }
+---
+
+# Security Check — Tool Risk Assessment
+
+Run risk assessment before executing potentially dangerous operations. Four-factor weighted scoring adapted from ECC.
+
+## When to Use
+
+- **Before Bash/exec** — always check risk
+- **Before Write/Edit** — check file sensitivity
+- **Before git push --force / rm -rf** — mandatory check
+- **Before database DROP/TRUNCATE** — mandatory check
+- **Before chmod/chown** — check blast radius
+
+## Tool
+
+```bash
+# JSON input mode (preferred)
+node src/security/risk-scorer.js '{"tool":"Bash","command":"rm -rf /tmp/build"}'
+
+# Simple mode
+node src/security/risk-scorer.js Write .env.production
+```
+
+## Risk Levels
+
+| Score | Action | Meaning |
+|:-----:|:------:|---------|
+| < 0.35 | **ALLOW** | Safe operation |
+| 0.35-0.60 | **REVIEW** | Review input before executing |
+| 0.60-0.85 | **CONFIRM** | Ask user for confirmation |
+| ≥ 0.85 | **BLOCK** | Refuse to execute |
+
+## Four Factors
+
+1. **Base tool risk** — Bash=0.20, Write=0.15, Read=0.02
+2. **File sensitivity** — .env +0.25, /etc/ +0.20, SSH keys +0.25
+3. **Blast radius** — rm -rf +0.35, curl-to-shell +0.25, SQL DROP +0.30
+4. **Irreversibility** — git push --force +0.45, hard reset +0.35
+
+## Integration Pattern
+
+```
+Before exec/write → risk-scorer → ALLOW → execute
+                                → REVIEW → show risk factors
+                                → CONFIRM → ask user
+                                → BLOCK → refuse, explain why
+```
+
+## File Path
+
+- `src/security/risk-scorer.js` — scoring engine