Security Check

🔒 Pre-installation security verification for external code and dependencies. Automated risk analysis for GitHub repos, npm packages, PyPI libraries, and she...

What to check before installing: 1) Clarify credentials: ask the author whether SNYK and/or a GitHub token are required, and if so where/how tokens are expected to be provided. The skill references Snyk and authenticated advisory endpoints but declares no required env vars—this should be explicit. 2) Confirm auto-install behavior: the skill's docs say 'auto-proceed' for items scored Safe. If you want manual control, verify configuration to disable auto-install, or require explicit confirmations for all installs. 3) Rate limits & failover: understand how the skill handles API rate limits and outages (the SKILL.md mentions caching and rate limiting as best practices but does not declare defaults). Without auth tokens GitHub rate limits are low and could cause failures. 4) Inspect files for obfuscated content: the scanner flagged a base64 block (from an SVG badge). Review all repository files for any other embedded/encoded content (base64, long data blocks) to ensure nothing hidden is executing or being used to inject prompts. 5) Test in a safe environment: run the skill in an isolated VM or sandbox and observe logs/behavior before letting it auto-install packages on your primary system. 6) Ask for an implementation or code: this skill is instruction-only in the package you provided. If the platform will run agent code based on these instructions, request the actual implementation code (how it executes checks and installs) so you can audit exact commands the agent will run. If you want, I can draft specific questions to ask the skill author (about tokens, auto-proceed defaults, logging, and sandboxing) or produce a short checklist to validate the implementation before trusting automatic installs.

Type: OpenClaw Skill Name: pre-install-security-check Version: 1.0.1 The 'pre-install-security-check' skill is a defensive tool designed to automate risk assessment for external code and dependencies (GitHub, npm, PyPI) before installation. It implements a transparent risk-scoring logic based on repository metrics and known vulnerability databases (GitHub Advisory, Snyk, OSV) and includes explicit guardrails to ensure user confirmation for risky packages. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the skill's behavior is entirely consistent with its stated security purpose.