Inspect TLS certificates for expiry, SANs, chain validity, and cipher details using Expanso Edge pipelines.

This skill appears to do what it says (inspect TLS certs), but exercise caution before installing/using it: - Command-injection risk: The CLI pipeline embeds the provided host directly into a shell command passed to sh -c. Do not run this skill on untrusted input or in contexts where an attacker can control the host string. Prefer sanitizing/validating host names (allow only hostname[:port] patterns) or modify the pipeline to avoid invoking a shell with unescaped user data. - Mode mismatch: CLI mode performs a real openssl connection; MCP mode returns mock/dummy certificate data. Treat MCP as a testing/mock endpoint only — it will not reflect real TLS state. - Missing metadata: The SKILL.md and pipeline require expanso-edge and openssl, but the skill registry metadata does not declare these required binaries. Confirm those dependencies are present before use. - Operational controls: If you will expose this to other users or wire it into automation, ensure input validation, run it in a least-privileged environment, and audit logs/outputs. If you are not comfortable reviewing or editing the pipeline to safely escape inputs, avoid installing it or ask the author to fix the shell invocation to use a safer API (avoid sh -c or properly escape/validate host input). If the maintainer can demonstrate that the runtime escapes/validates host input or replace the sh -c invocation with a safer call (e.g., exec openssl directly without shell interpolation), the remaining concerns would be largely resolved.

Type: OpenClaw Skill Name: expanso-tls-inspect Version: 1.0.0 The `pipeline-cli.yaml` file contains a critical shell injection vulnerability. User-controlled input (`this.host` and `this.host_with_port`), derived directly from the skill's input, is embedded without sufficient sanitization into a `sh -c` command that executes `openssl`. This allows an attacker to inject arbitrary shell commands by crafting the input hostname, leading to potential remote code execution. While the skill's stated purpose is benign (TLS inspection), this severe input sanitization flaw makes it suspicious.