Skill Reviewer Pro

Performs thorough format validation, content quality assessment, and functional verification of OpenClaw skills for compliance and completeness.

The skill's content appears to do what it claims (skill review) and has no install/secret requests, but the package metadata is inconsistent: _meta.json differs from the registry metadata (ownerId, slug, version) and there is no known source or homepage. Before installing or using this skill, ask the publisher to confirm the authoritative source and why the _meta.json differs. Prefer obtaining the skill from a verifiable homepage or registry entry, request a signed/verified package or checksum, and test the skill in an isolated sandbox. Do not grant sensitive credentials or system-level privileges to this skill until provenance is confirmed. If the publisher cannot explain the metadata mismatch, treat the package as untrusted.

Type: OpenClaw Skill Name: skill-reviewer-pro Version: 2.1.1 The skill `skill-reviewer-pro` is designed to review other OpenClaw skills. Its `SKILL.md` contains an explicit instruction for the AI agent to execute a local Python script: `python3 /home/yupeng/.npm-global/lib/node_modules/openclaw/skills/skill-creator/scripts/package_skill.py <skill-path>`. While this command is intended for legitimate skill validation, it represents a direct command execution instruction. If the `<skill-path>` argument can be manipulated by a malicious input or skill, it could lead to a shell injection vulnerability (RCE). This is classified as suspicious because it introduces a high-risk capability (command execution) that, while aligned with its stated purpose, presents a significant vulnerability risk without clear evidence of malicious intent from this specific skill.