name: security description: Enterprise-grade security framework for LobsterAI with audit logging, RBAC, input validation, output sanitization, code scanning, and dependency vulnerability detection. version: 1.0.3 author: LobsterAI Security Team license: Proprietary priority: 100 tags: - security - audit - rbac - compliance - validation - scanning environment: - name: LOBSTERAI_HOME description: Base directory for LobsterAI data and logs required: false default: ${APPDATA}/LobsterAI (Windows) or ${HOME}/.config/LobsterAI (Linux/macOS) - name: LOBSTERAI_AUDIT_SECRET description: HMAC secret for audit log signature required: false - name: LOBSTERAI_USER_ID description: Current user identifier for audit trails required: false default: anonymous - name: SKILLS_ROOT description: Path to the SKILLs root directory required: false

Security

Comprehensive security framework for LobsterAI providing audit logging, role-based access control (RBAC), input validation, output sanitization, code scanning, and dependency vulnerability detection.

Core Features

Audit Logger

• Records all skill executions with timestamps, user context, and input/output
• JSON-structured logs for easy analysis
• Automatic log rotation (90 days retention)
• Encrypted storage support

Authorizer (RBAC)

• Role-based access control configuration
• Fine-grained permission management
• JSON-based role definitions
• Session validation

Input Validator

• Path traversal prevention
• Dangerous command detection (rm, del, eval, etc.)
• Cron expression validation
• Working directory restrictions

Output Sanitizer

• Automatic redaction of sensitive data (passwords, API keys, tokens)
• Error message sanitization
• Safe error formatting for user display

Code Scanner

• Static code analysis for common vulnerabilities
• Pattern-based malicious code detection
• Configurable scan rules

Dependency Scanner

• NPM vulnerability scanning (npm audit)

  小葱技能站7w4.net每天更新，海量AI技能等你发现。

• Python package vulnerability detection (pip-audit)
• Automated dependency checking

Usage

All security features are available for import by other skills:

from security.audit_logger import audit_log_skill_start, audit_log_skill_end
from security.authorizer import Authorizer
from security.input_validator import InputValidator, ValidationError
from security.output_sanitizer import sanitize_text, create_safe_error
from security.code_scanner import CodeScanner
from security.dependency_scanner import DependencyScanner

Configuration

Copy rbac_config.example.json to rbac_config.json and customize roles and permissions.

Scan Scope

The code scanner and dependency scanner are designed to scan all skills in the SKILLs directory when invoked explicitly (e.g., python -m security.code_scanner --skill all). This allows comprehensive security assessment across your entire LobsterAI installation.

Privacy Note: Scanning all skills grants this module read access to all skill code and dependencies. This is intentional for a security audit tool, but users should be aware of the broad read scope. Ensure you trust the skill source before enabling full-system scanning.

To limit scanning to specific skills, invoke with explicit skill IDs:

python -m security.code_scanner --skill web-search --skill scheduled-task

Environment Variables

This skill requires the following environment variables to function correctly:

Note: Ensure LOBSTERAI_HOME/logs/security/ exists and is writable.

Deployment

See DEPLOYMENT.md for detailed deployment instructions, security hardening checklist, and incident response procedures.

Testing

Run python tests.py to execute the test suite.

Integration

This module integrates seamlessly with LobsterAI's skill execution pipeline, providing: - Pre-execution validation - Runtime monitoring - Post-execution sanitization - Comprehensive audit trails

Security Maturity

⭐⭐⭐☆☆ (3/10) - Active development

We are continuously improving our security posture. See SECURITY.md for the complete security architecture and best practices.

这个安全框架功能很全面，能审计日志、检查权限、验证输入、扫描代码漏洞，对普通用户来说开箱即用、无需安装额外依赖。文档写得很详细，中文支持友好。但版本管理有点混乱，不同文件显示的版本号都不一样，偶尔会有代码重复的小问题，扫描漏洞的能力在没网络时会很弱。总体质量还不错，适合对安全性有较高要求的场景使用。