Service Catalog

Auto-discover and catalog all services in a codebase or organization — scan Dockerfiles, docker-compose, Kubernetes manifests, package.json, systemd units, P...

This skill mostly does what it says: it scans a codebase for service artifacts and builds a catalog. Before installing or running it: (1) be aware it reads many repository files and may surface secrets or private endpoints — run it in a trusted or isolated checkout if you have sensitive data; (2) the SKILL.md uses tools like python3 and rg (ripgrep) but the skill doesn't declare required binaries — ensure those tools are present and consider adding them to a vetted runtime rather than installing unknown packages; (3) the description mentions 'organization' scanning but the commands are local to the workspace — don't expect it to reach into external repos or org-level services unless you explicitly provide those checkouts; (4) review where the skill will write or transmit its output (not specified) and avoid piping results to external endpoints unless you trust them. If you want to proceed, test on a non-sensitive repository and confirm outputs are limited to local files or agent UI before running on production codebases.

Type: OpenClaw Skill Name: service-catalog Version: 1.0.0 The skill bundle contains multiple shell injection vulnerabilities in the `SKILL.md` file, specifically within the `discover` and `owners` commands where file paths found by `find` are directly interpolated into `python3 -c` command strings. While the tool's functionality for service discovery and dependency mapping is clearly defined and legitimate, these vulnerabilities allow for potential arbitrary code execution if the agent processes a repository containing maliciously named files. Additionally, the tool performs broad searches for sensitive configuration keys like `DATABASE_URL` and `REDIS_URL` and pings local endpoints, which are high-risk behaviors albeit aligned with the stated purpose of infrastructure cataloging.