奇安信 SafeSkill 安全中心 / QAX SafeSkill Security Center

简体中文 | English

简体中文

面向 Cursor、OpenAI Codex 和 Claude Code 的 Agent Skill 安全检测、自动监控与安装前防护插件。

SafeSkill 帮助你统一发现和管理本机及工作区中的 Agent Skill，通过 SafeSkill API 获取安全结论，并在发现风险时及时提醒。

核心能力

• 自动发现 Cursor、Codex 和 Claude Code 的用户级及工作区级 Skill。
• 默认每 10 秒检查目录变化，新增、删除或修改后自动刷新列表。
• 配置 API Token 后，自动检测新增或发生变化的 Skill。
• 新发现的警告或危险 Skill 会立即通知，并可直接查看报告或打开目录。
• 导入本地目录或 ZIP 前先检测；安全、可疑和危险结果均由用户最终决定是否安装。
• 在安全中心统一扫描、回扫、查看报告、打开目录和管理 Skill。

快速开始

1. 点击 VS Code 左侧 Activity Bar 中的 SafeSkill 盾牌图标，打开安全中心。
2. 点击“配置 Token”，或运行命令 SafeSkill：配置 API Token。
3. 点击“全盘扫描”，检测当前已经安装的 Skill。

Token 保存于 VS Code SecretStorage，不会写入 settings.json，也不会在界面中显示明文。

界面语言

SafeSkill 支持简体中文和英文。点击 Skill 管理视图标题栏中的地球图标，或运行命令 SafeSkill：切换界面语言，可选择“自动（跟随 VS Code）”“简体中文”或“English”。运行时页面、树视图、通知和对话框会立即更新；Activity Bar、命令和设置标题由 VS Code 扩展清单本地化机制控制，跟随 VS Code 显示语言。

检测状态

安装前防护

点击“检测并安装 Skill”可以导入包含 SKILL.md 的本地文件夹或 ZIP 压缩包，并选择安装到 Cursor、Codex 或 Claude Code 的用户级或工作区级目录。

SafeSkill 会先查询历史报告，必要时提交 API 分析。取得最终风险结论后，插件展示报告和风险提示，由用户决定是否写入目标目录：

• 安全：用户确认后安装。
• 可疑：显示风险，用户了解风险后可选择安装或取消。
• 危险：显示强风险警告，用户仍保留安装或取消的最终决定权。

ZIP 导入同时检查路径穿越、绝对路径、符号链接、重复路径、CRC、文件数量和解压体积等问题。

SkillHub 浏览与安装

打开“奇安信 SafeSkill 安全中心”，切换到 SkillHub 页签，即可浏览 SafeSkill SkillHub 中已上架的 Agent Skill。安装前会对下载内容执行安全检测。

• 支持按名称搜索、分类筛选，以及按热度、下载量或名称排序。
• 使用服务端分页浏览列表，可在安全中心内查看条目详情或打开线上详情页。
• SkillHub 列表和详情可匿名浏览；点击“安装”后复用安全中心已配置的 API Token，再选择 OpenAI Codex、Cursor 或 Claude Code 的用户级或工作区级目录。
• 托管包下载复用已配置的 API Token，并遵守任务下载接口的查询权限与任务可见性检查；不再收集 SkillHub 登录密码。Token 鉴权支持用户配置的 HTTP 或 HTTPS 服务地址。HTTP 会明文传输 Token，建议仅用于可信网络，生产环境推荐 HTTPS。
• 通过 /openapi/v1/hub 获取当前条目的关联 task_id，再调用 GET /openapi/v1/download?task_id=... 获取 S3 等存储中的托管安装包地址。不使用条目的 GitHub 来源页，也不按名称猜测其他任务。不再使用服务端历史哈希校验下载包；凭据不传递给存储重定向。随后复用普通扫描流程，按包哈希查询历史报告，未命中再提交。取得最终结论后由用户决定是否安装，安装前再次核验内容。扫描仍要求原有提交/查询权限。
• 下载完成后仍会执行本地安全校验，包括 ZIP 路径、符号链接、CRC、文件数量、解压体积和唯一 SKILL.md 检查。
• 目标目录存在同名 Skill 时，必须由用户确认后才会替换；取消或失败不会留下半安装目录。

自动监控

目录监控默认每 10 秒检查一次。即使没有配置 Token，新增、删除或修改的 Skill 也会自动出现在列表中，但不会调用检测 API，并显示为“未检测”。

配置 Token 后，新增或内容发生变化的 Skill 会自动提交检测。通过第三方工具安装的 Skill 通常是在文件写入后被快速发现和检测；如需安装前阻断，请使用 SafeSkill 自带的“检测并安装 Skill”流程。

支持的 Skill 目录

插件还会发现工作区中的 .agents/skills，并将 Codex .system Skill 作为只读项目展示。

常用操作

• 全盘扫描：检测当前发现的全部 Skill。
• 扫描 Skill：查询历史报告，必要时提交新任务；若命中的 completed 历史任务明确缺少报告，自动绕过去重并强制提交一次新扫描。
• 强制回扫：跳过历史报告，要求后台创建新的检测任务。
• 查看报告：查看 API 裁决、风险项、位置、证据和修复建议。
• 检测并安装 Skill：检测通过后安装本地文件夹或 ZIP。
• 删除 Skill：确认后删除用户级或工作区级 Skill；只读系统 Skill 不提供删除操作。

主要设置

隐私与安全边界

• 所有安全结论和风险项均来自 SafeSkill API，插件不使用本地离线规则生成安全或危险结论。
• 没有 Token 时，插件只发现和展示 Skill，不会提交 API 检测。
• 检测任务以非公开方式提交。
• 删除 Skill、清除 Token、初始化状态和强制回扫等敏感操作均需要确认。
• 第三方 Agent 不一定提供可靠的 Skill 调用事件；建议检测所有已启用 Skill，需要安装前保护时使用 SafeSkill 导入流程。

查看日志

打开 查看 → 输出（Ctrl+Shift+U），然后选择 SafeSkill。最近活动只显示一行失败摘要；输出通道记录任务 ID、失败阶段、失败码、错误堆栈和脱敏后的 API 响应。Token、Authorization、密码和 URL 凭据会被遮罩。

English

Security scanning, automatic monitoring, and pre-installation protection for Agent Skills used by Cursor, OpenAI Codex, and Claude Code.

SafeSkill discovers and manages Agent Skills installed on your machine or in the current workspace. It obtains security verdicts from the SafeSkill API and alerts you when risks are detected.

Core capabilities

• Automatically discover user-level and workspace-level Skills for Cursor, Codex, and Claude Code.
• Check Skill directories every 10 seconds by default and refresh the list after additions, removals, or changes.
• Automatically scan newly installed or modified Skills after an API credential is configured.
• Notify you when a newly discovered Skill is suspicious or dangerous, with direct access to its report or directory.
• Scan a local folder or ZIP before installation; the user always makes the final installation decision for safe, suspicious, and dangerous results.
• Scan, rescan, inspect reports, open directories, and manage Skills from one security center.

Quick start

1. Select the SafeSkill shield icon in the VS Code Activity Bar to open the Security Center.
2. Select Configure Credential, or run SafeSkill: Configure API Credential.
3. Select Scan All to scan the currently installed Skills.

The credential is stored in VS Code SecretStorage. It is never written to settings.json or displayed in plaintext.

Interface language

SafeSkill supports Simplified Chinese and English. Select the globe icon in the Skill Management view title, or run SafeSkill: Switch Interface Language, then choose Auto (Follow VS Code), Simplified Chinese, or English. Runtime pages, tree views, notifications, and dialogs update immediately. Activity Bar labels, commands, settings titles, and this native Details page are controlled by VS Code separately. Use the links at the top of this page to switch between the Chinese and English documentation.

Scan status

Pre-installation protection

Select Scan and Install Skill to import a local folder or ZIP containing SKILL.md, then choose a user-level or workspace-level installation target for Cursor, Codex, or Claude Code.

SafeSkill looks for a historical report first and submits API analysis when needed. After a final verdict is available, the extension presents the report and risk notice so you can decide whether to install:

• Safe: install after user confirmation.
• Suspicious: show the risks and let the user install or cancel after acknowledging them.
• Dangerous: show a strong warning while preserving the user's final choice to install or cancel.

ZIP imports also validate path traversal, absolute paths, symbolic links, duplicate paths, CRC values, file count, and extracted size.

SkillHub browsing and installation

Open SafeSkill Security Center and switch to the SkillHub tab to browse published Agent Skills on SafeSkill SkillHub.

• Search by name, filter by category, and sort by popularity, downloads, or name.
• Browse server-paginated results and open item details inside the Security Center or online.
• SkillHub lists and details are available anonymously. Installation uses the configured SafeSkill API token and requires selecting an OpenAI Codex, Cursor, or Claude Code user-level or workspace-level target.
• Hosted downloads use the configured API token and retain task-query permission and task visibility checks. No separate password is collected. Token requests support the configured HTTP or HTTPS server. HTTP transmits tokens in plaintext; use it only on trusted networks and prefer HTTPS in production.
• Resolve the current Hub item's task_id via /openapi/v1/hub, then GET /openapi/v1/download?task_id=... for its hosted storage URL. Do not use the GitHub source page or guess another task by name. The API token is never sent to storage; historical server hashes are not compared against the download, and credentials are never forwarded on storage redirects. The normal scan flow then reuses a hash-matched report or submits the package. A final scan result and user confirmation are required before installation, followed by a content recheck. Scanning retains its existing submit/query permission checks.
• Downloaded packages still undergo local ZIP safety checks, including path, symbolic-link, CRC, file-count, extracted-size, and unique-SKILL.md validation.
• Replacing an existing Skill requires user confirmation. Cancellation or failure does not leave a partially installed directory.

Automatic monitoring

Directory monitoring runs every 10 seconds by default. Without a configured credential, added, removed, or modified Skills still appear in the list, but they are not submitted to the API and remain Not scanned.

After a credential is configured, new or modified Skills are scanned automatically. Skills installed by third-party tools are normally detected shortly after files are written. For pre-installation blocking, use SafeSkill's own Scan and Install Skill workflow.

Supported Skill directories

The extension also discovers .agents/skills in workspaces and displays Codex .system Skills as read-only entries.

Common actions

• Scan All: scan every discovered Skill.
• Scan Skill: look for a historical report and submit a new task when needed. If a matched completed task explicitly has no report, bypass deduplication and automatically submit one forced rescan.
• Force Rescan: skip historical-report reuse and require the backend to create a new scan task.
• View Report: inspect the API verdict, findings, locations, evidence, and remediation guidance.
• Scan and Install Skill: scan and then install a local folder or ZIP.
• Remove Skill: remove a user-level or workspace-level Skill after confirmation. Read-only system Skills cannot be removed.

Main settings

Privacy and security boundaries

• All security verdicts and findings come from the SafeSkill API. The extension does not generate safe or dangerous verdicts with local offline rules.
• Without a credential, the extension only discovers and displays Skills; it does not submit API scans.
• Scan tasks are submitted privately.
• Sensitive actions such as removing a Skill, clearing the credential, initializing states, and manually forcing a rescan require confirmation.
• Third-party agents might not provide reliable Skill invocation events. Scan every enabled Skill and use the SafeSkill import workflow when pre-installation protection is required.

Logs

Open View → Output (Ctrl+Shift+U) and select SafeSkill. Recent Activity shows a one-line failure summary, while the output channel records task IDs, failure stages, failure codes, stack traces, and sanitized API responses. Tokens, Authorization headers, passwords, and URL credentials are redacted.