Snyk Skill Scanner

Scan installed agent components (MCP servers, skills, agent tools) for security vulnerabilities using snyk-agent-scan. Use only when running uvx snyk-agent-s...

This skill is coherent for its stated purpose, but it relies on fetching and running third-party tooling at scan time. Before you use it: 1) verify the authenticity of uvx/uv and snyk-agent-scan (check official project pages, release signatures, and the GitHub repository referenced), 2) avoid piping unknown curl scripts into sh — prefer package managers or audited install steps, 3) run scans from a least-privilege or isolated environment if possible, and 4) review scan results carefully before taking automated remediation steps. If you need higher assurance, ask the skill author for a pinned release URL or signed binary rather than using @latest.

Type: OpenClaw Skill Name: snyk-skill-scanner Version: 1.0.0 The skill bundle is designed for security auditing, explicitly stating its purpose to 'Scan installed agent components... for security vulnerabilities using snyk-agent-scan'. It provides clear instructions for executing the `uvx snyk-agent-scan` tool and installing its prerequisite `uv`. There is no evidence of prompt injection attempts against the agent, data exfiltration, backdoor installation, or any other malicious intent. The use of `curl | sh` for `uv` installation, while a general supply chain risk, is a common practice for legitimate tool installation and is openly documented as a prerequisite, not a hidden malicious payload.