Skill Security Scanner by dxx

Scan installed OpenClaw skills for potential security risks. Use when you want to check if skills contain dangerous commands, access sensitive paths, or have...

This script appears to be a straightforward local scanner. Before running it, inspect the skill_scan.py yourself (you already have the source) and confirm it contains no network calls or code-execution paths (it does not). Run it in a safe/test environment if any skills contain sensitive secrets, since the scanner will read files under ~/.openclaw/workspace/skills. If you use it regularly, consider improving false-positive handling and binary detection, and avoid trusting scanner output as a replacement for manual review of flagged files.

Type: OpenClaw Skill Name: skill-security-scan-dxx Version: 1.0.0 The skill is a security utility designed to perform static analysis on other installed OpenClaw skills to identify potentially dangerous commands, sensitive path access, and insecure network requests. The Python script `skill_scan.py` implements a straightforward regex-based scanner that checks for patterns like 'rm -rf', fork bombs, and access to directories like ~/.ssh/ or ~/.aws/. The code uses only standard libraries, does not exfiltrate data, and its behavior is entirely consistent with the documentation provided in SKILL.md.