FANG — ENV Guard#

Two-phase audit tool to detect environment variable theft in skill scripts.

Scripts#

ScriptPurposescripts/fang_audit.pyMain audit runner — static scan + LLM deep analysisscripts/scan_env.pyStatic pattern scanner (env / network / encode / exec)

Phase 1 — Static Scan#

Uses scan_env.py regex rules across .py and .sh files.

Risk scoring:

FlagPointsenv access+2network call+3base64 / encode+2exec / subprocess+2

Score ≥ 6 → HIGH · ≥ 3 → MEDIUM · > 0 → LOW · 0 → CLEAN

Phase 2 — LLM Deep Analysis (optional)#

Reads all .py .sh .js .ts .ps1 .bash scripts in the target directory and sends them to an OpenAI-compatible LLM. The LLM checks for:

• Env reads combined with outbound HTTP/socket/DNS
• Obfuscation: base64, hex, eval, dynamic imports
• Hardcoded exfiltration endpoints
• Suspicious subprocess chains

Usage#

Basic static scan only#

bash

python scripts/fang_audit.py <target_dir>

With LLM deep analysis#

bash

python scripts/fang_audit.py <target_dir> --llm-key sk-... --model gpt-4o-mini

OpenAI-compatible API (e.g. local Ollama / DeepSeek)#

bash

python scripts/fang_audit.py <target_dir> \
  --llm-key any \
  --model deepseek-chat \
  --base-url https://api.deepseek.com/v1

Save report to file#

bash

python scripts/fang_audit.py <target_dir> --llm-key sk-... --output report.txt

Scan all workspace skills at once#

bash

python scripts/fang_audit.py C:/Users/dad/.openclaw/workspace/skills

Agent Workflow#

When the user asks to audit skills for env theft:

1. Ask for the target directory (default: workspace skills/ folder)
2. Run Phase 1 static scan — report summary immediately
3. If HIGH or MEDIUM risks found, ask whether to run LLM deep analysis
4. If --llm-key is available (from env or user), run Phase 2 automatically
5. Present the final threat report:
   • List each risky file with risk level + reason
   • Highlight any CRITICAL combined patterns (env read + network send)
   • Recommend action: QUARANTINE (HIGH), REVIEW (MEDIUM), MONITOR (LOW)

Risk Response Guide#

Risk LevelRecommended Action🔴 HIGHImmediately quarantine the skill, do not run it🟡 MEDIUMManual code review before use🟢 LOWMonitor; likely benign but worth noting✅ CLEANSafe to use

Notes#

• The LLM analysis truncates each file to 3000 chars to stay within token limits.
• For very large skill directories, consider scanning one skill at a time.
• scan_env.py only processes .py and .sh files; fang_audit.py LLM mode also covers .js, .ts, .ps1.