Scan OpenClaw skill directories for 22 supply chain attack patterns with context-aware detection, colored output, JSON reports, and whitelist support.

This package is largely coherent with its claimed purpose (a local scanner), but there are a few things to check before installing or running it: - Clarify the mismatches: SKILL.md mentions 22 rules while README and scripts indicate 55+ rules; confirm which rules will actually run. - Ensure required system tools are available: the scripts assume standard Unix tools; python3 is optional but needed for deeper AST checks; git is used by --pre-install. The registry metadata did not list these binaries — don't rely solely on the metadata. - Be cautious with --pre-install: it clones remote git URLs (network activity). When scanning untrusted repos, run the tool in an isolated environment (sandbox, container, or CI worker) to avoid any accidental execution of untrusted code. - Review the included scripts yourself (audit.sh and ast_analyzer.py are provided) or run them on test data first. They are intended to scan for secrets and dangerous constructs but will read all files in the target directory — do not point it at sensitive home directories. - If you need high assurance, request the publisher/source (homepage is missing) or prefer a scanner from a known repository; otherwise run in a disposable environment and inspect outputs carefully. Confidence is medium because inconsistencies look like sloppy packaging rather than malicious intent, but the lack of declared runtime dependencies and the network-enabled pre-install mode increase risk until clarified.

Type: OpenClaw Skill Name: giraffe-guard Version: 3.1.0 This OpenClaw skill bundle, 'Giraffe Guard', is a security scanner designed to detect supply chain attacks and malicious code. Both `SKILL.md` and `README.md` clearly describe its purpose and usage, without any prompt injection attempts or malicious instructions for the AI agent. The core scripts (`scripts/audit.sh` and `scripts/ast_analyzer.py`) implement a wide array of detection rules targeting common malicious patterns (e.g., RCE, data exfiltration, persistence, obfuscation) in *other* code, not performing these actions themselves. The tool explicitly includes a rule to detect prompt injection in `SKILL.md` and uses only standard system utilities and Python's standard library, indicating a well-intentioned security utility.