Alibaba Cloud Linux:Using AgentSecCore

Scenario 1: Scan a single or all skills

Performs a full security scan and signature certification (Phase 1: Environment preparation → Phase 2: File-by-file security review → Phase 3: Signing and recording to chain) for a specified Skill or all Skills. When a single Skill is specified, the report contains results for only that Skill. After completion, the Agent outputs an Execution Report:

[skill-ledger] Execution Report
┌─────────────┬────────────┬──────────┬──────────────────┬─────────────────────┬────────┬──────────────────────┐
│ Skill       │ Status     │ Version  │ Status Fingerprint │ Last Updated        │ Files  │ Summary              │
├─────────────┼────────────┼──────────┼──────────────────┼─────────────────────┼────────┼──────────────────────┤
│ github      │  pass      │ v000001  │ 5e2d1a8          │ 2025-04-23T15:30:00Z│ 5      │ No risks found       │
│ my-tool     │  warn      │ v000002  │ 9c3f7b1          │ 2025-04-23T15:31:00Z│ 3      │ 2 warnings           │
│ docker      │  pass      │ v000002  │ 7d4e9b0          │ 2025-04-19T08:15:00Z│ 8      │ Reused last result   │
└─────────────┴────────────┴──────────┴──────────────────┴─────────────────────┴────────┴──────────────────────┘

Security Conclusion:
   pass: 2     warn: 1    Total: 3 Skills

   my-tool - 2 low-risk findings:
    • obfuscated-code - Overly long single line of code (lib/encoder.js:203)
    • suspicious-network - Direct connection to an IP on a non-standard port (net/client.py:88)

Scenario 2: Check the status of a single or all skills

Checks only the integrity status of a specified Skill or all Skills without performing a scan. When a single Skill is specified, the report includes only that Skill. The Agent outputs a Security Status Report:

[skill-ledger] Security Status Report
┌─────────────┬────────────┬──────────┬──────────────────┬─────────────────────┬────────┬──────────────────────┐
│ Skill       │ Status     │ Version  │ Status Fingerprint │ Last Updated        │ Files  │ Summary              │
├─────────────┼────────────┼──────────┼──────────────────┼─────────────────────┼────────┼──────────────────────┤
│ github      │  none      │ v000001  │ 3f8a1c2          │ 2025-04-20T10:30:00Z│ 5      │ Never scanned        │
│ docker      │  pass      │ v000002  │ 7d4e9b0          │ 2025-04-19T08:15:00Z│ 8      │ No risks found       │
│ my-tool     │  drifted   │ v000001  │ a91c5f3          │ 2025-04-18T14:00:00Z│ 3      │ +1 added, ~1 modified│
│ dev-helper  │  warn      │ v000003  │ c0b7e28          │ 2025-04-17T09:00:00Z│ 12     │ 2 warnings           │
└─────────────┴────────────┴──────────┴──────────────────┴─────────────────────┴────────┴──────────────────────┘

Security Conclusion:
  Passed: 1 (docker)
  Needs attention: 3 - 1 never scanned, 1 file changed, 1 low-risk

  my-tool: SKILL.md and run.py were modified, new-helper.sh was added.
  dev-helper: obfuscated-code (utils.js:142), suspicious-network (fetch.py:58)

  Recommendation: Perform a security scan on Skills with a non-pass status to update their status.

Automatic hook protection

In addition to being actively triggered through the Skill as described above, Skill Ledger also uses a hook mechanism to automatically perform integrity checks when a Skill is called:

• Copilot Shell: Before a Skill tool is called, its integrity status is automatically checked. The current version is designed for minimal intervention and does not block execution or display warnings on the UI. However, all verification records are saved in the logs and can be queried through the observability capability.

• OpenClaw: Implements the same automatic check capability through a security plugin, with behavior identical to that of Copilot Shell.

Step 1: Initialize signing keys

agent-sec-cli skill-ledger init-keys

This command generates an Ed25519 key pair, with no passphrase and zero interaction by default. The keys are stored in ~/.local/share/agent-sec/skill-ledger/.

Expected output:

{
  "command": "init-keys",
  "fingerprint": "sha256:a3b1c9...",
  "publicKeyPath": "/home/user/.local/share/agent-sec/skill-ledger/key.pub",
  "privateKeyPath": "/home/user/.local/share/agent-sec/skill-ledger/key.enc",
  "encrypted": false
}

We recommend enabling passphrase protection in production environments:

# Enter the passphrase interactively
agent-sec-cli skill-ledger init-keys --passphrase

# Or pass it via an environment variable (for CI/CD)
SKILL_LEDGER_PASSPHRASE="your-secret" agent-sec-cli skill-ledger init-keys --passphrase

Step 2: Check Skill integrity

# Check a single Skill
agent-sec-cli skill-ledger check /path/to/your-skill

# Check all registered Skills in bulk
agent-sec-cli skill-ledger check --all

The first check creates a baseline manifest with a none status. Subsequent checks report file changes, signature status, and scan results.

Expected output:

{
  "status": "drifted",
  "skillName": "your-skill",
  "versionId": "v000001",
  "createdAt": "2025-04-20T10:30:00Z",
  "updatedAt": "2025-04-22T14:00:00Z",
  "fileCount": 5,
  "manifestHash": "sha256:3f8a1c2...",
  "added": ["new-file.sh"],

  "removed": [ ],

  "modified": ["SKILL.md"]
}

Status Definitions and Recommended Actions:

Step 3: Perform security scan and certification

If a findings file already exists (for example, from an Agent scan), call certify directly:

agent-sec-cli skill-ledger certify /path/to/your-skill \
  --findings /tmp/skill-vetter-findings-your-skill.json \
  --scanner skill-vetter

Expected output:

{
  "versionId": "v000002",
  "scanStatus": "pass",
  "newVersion": true,
  "skillName": "your-skill",
  "createdAt": "2025-04-20T10:30:00Z",
  "updatedAt": "2025-04-23T15:31:00Z",
  "fileCount": 5,
  "manifestHash": "sha256:5e2d1a8..."
}

scanStatus represents the aggregated security status: pass (no risks), warn (low risk), or deny (high risk).

Note on passphrases: If the key is protected by a passphrase, you must pass it via an environment variable: SKILL_LEDGER_PASSPHRASE="your-passphrase" agent-sec-cli skill-ledger certify ...

Step 4: View configuration and health

# View keys, configuration, and the health of all Skills
agent-sec-cli skill-ledger status

# Include detailed status for each Skill
agent-sec-cli skill-ledger status --verbose

Expected output:

{
  "command": "status",
  "keys": {
    "initialized": true,
    "fingerprint": "sha256:a3b1c9...",
    "publicKeyPath": "/home/user/.local/share/agent-sec/skill-ledger/key.pub",
    "encrypted": false,
    "keyringSize": 0
  },
  "config": {
    "configPath": "/home/user/.config/agent-sec/skill-ledger/config.json",
    "customized": false,
    "skillDirPatterns": 4,
    "registeredScanners": ["skill-vetter"]
  },
  "skills": {
    "discovered": 5,
    "breakdown": { "pass": 3, "none": 1, "drifted": 1, "warn": 0, "deny": 0, "tampered": 0, "error": 0 },
    "health": "attention"
  }
}

The health tag can have the following values: healthy (all Skills passed), attention (drift or low-risk findings), critical (high-risk findings or tampering detected), unscanned (never scanned), or empty (no registered Skills).

Step 5: Audit the version chain (optional)

# Basic audit
agent-sec-cli skill-ledger audit /path/to/your-skill

# Also verify snapshot file hashes
agent-sec-cli skill-ledger audit /path/to/your-skill --verify-snapshots

This command performs a deep verification of all historical versions by checking hashes, signature validity, and version links. This is useful for compliance audits, post-incident forensics, and similar scenarios.

Expected output:

{
  "valid": true,
  "versions_checked": 3,

  "errors": [ ]

}

Step 6: List registered scanners (optional)

agent-sec-cli skill-ledger list-scanners

Lists all registered scanners and their enabled status. Use this to confirm the available scanner names for the certify --scanner command.

Expected output:

{
  "command": "list-scanners",
  "scanners": [
    { "name": "skill-vetter", "type": "skill", "parser": "findings-array", "enabled": true, "description": "Agent-driven skill security vetter" }
  ]
}

Scenario 1: Audit and harden system baseline

# Scan the security baseline for the operating system
agent-sec-cli harden --scan --config agentos_baseline

Expected results:

• Performs a basic baseline scan, completing checks for the five security domains within 5 seconds.

• Automatically identifies non-compliant items and provides clear root cause analysis and remediation suggestions.

• You can run reinforce to automatically fix the issues with a single command, completing the hardening process in seconds.

Scenario 2: Run OpenClaw baseline check

# Perform a dedicated security baseline check for the OpenClaw runtime environment
agent-sec-cli harden --scan --level openclaw

Use cases:

• Perform an environment security check before and after deploying OpenClaw.

• Periodically inspect the security baseline of the OpenClaw runtime environment.

Expected result:

• Outputs a dedicated system security baseline report that highlights risks specific to OpenClaw.

Scenario 1: Network access (allowed)

# Enter a prompt to download a web page to the /tmp directory
Download the Alibaba Cloud official website page to the /tmp directory

Expected results:

• The command is executed within the sandbox.

• The network connection is allowed (network commands are automatically permitted).

• The file system is still restricted, so you cannot use curl to download files to a system directory.

Scenario 2: Download to critical directory (blocked)

# Enter a prompt that attempts to download to the /etc directory
Download the Alibaba Cloud official website page to the /etc directory

Expected results:

• Writing to /etc is denied.

• The Agent prompts: "Cannot write to a system directory. Please save to /tmp or the current directory."

• Even if network access is available, write protection for sensitive directories remains in effect.

Scenario 3: Block a dangerous system command

# Attempt to restart the system
reboot

Expected results:

• The command is blocked immediately and does not enter the sandbox for execution.

• The Agent responds: "This command involves a dangerous system operation and has been blocked by the security policy."

• The system is not restarted or shut down.

Scenario 4: File system operation (allowed)

# Operate within the /tmp directory
mkdir -p /tmp/test_dir && rm -rf /tmp/test_dir

Expected results:

• The command is successfully executed within the sandbox.

• /tmp/test_dir is created and then deleted.

• Other system directories are not affected.

Scenario 5: File system operation (blocked)

# Attempt to write to a system directory
echo "test" > /etc/test.txt

Expected results:

• The command fails to execute within the sandbox.

• A "Read-only file system" error is returned.

• The Agent prompts: "Cannot write to a system directory. If you must make changes, run the command outside the sandbox."

Scenario 6: Intercept a dangerous system call

# Attempt to execute the ptrace system call
python3 -c "import ctypes; libc = ctypes.CDLL(None); libc.ptrace(0, 0, None, None)"

Expected results:

• The command is executed within the sandbox.

• The ptrace call is intercepted, and EPERM (errno=1) is returned.