Supply Chain Poison Detector

Helps detect supply chain poisoning in AI agent marketplace skills. Scans Gene/Capsule validation fields for shell injection, outbound requests, and encoded...

This skill appears coherent for static supply-chain scanning, but keep these cautions in mind: 1) It will fetch remote assets if you give an EvoMap/URL — avoid giving it URLs that require authentication or that will trigger unintended operations. 2) Do not paste secrets or private files into the scanner input. 3) Because SKILL.md is high-level and provides no concrete script/regex, review the scanner's implementation (or run it in an isolated environment) before relying on results; false negatives are possible. 4) Ensure curl and python3 on your system come from trusted sources. If you need stricter guarantees, request the actual analysis code from the author or run an independent, auditable scanner in a sandbox.

Type: OpenClaw Skill Name: supply-chain-poison-detector Version: 1.0.1 The skill 'supply-chain-poison-detector' is a security tool designed to identify malicious patterns (such as shell injection, data exfiltration, encoded payloads, and sensitive file access) within other AI agent skills. Both the `_meta.json` and `SKILL.md` files consistently describe this legitimate security purpose. The required binaries (`curl`, `python3`) are appropriate for its stated function, and there are no instructions or code within the provided files indicating that *this* skill performs any malicious actions itself, nor any prompt injection attempts against the agent.