← Back to Skills Marketplace
158
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install osv-ui
Description
Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human r...
Usage Guidance
This skill appears to do what it claims: run osv-ui via npx, show a dashboard, and propose fixes. Before using it, ensure you: (1) have Node/npm and npx available or adjust the instructions; (2) understand that npx will fetch and execute code from the npm registry — review or pin the osv-ui package source/version if you require higher assurance; (3) run scans in an isolated environment (container/VM) if you're worried about executing remote code or exposing local registry credentials; (4) verify the skill asks for explicit confirmation before it runs npm install (it does in SKILL.md); and (5) check for sensitive tokens in your .npmrc or environment that npm/npx could use. If you want lower risk, install osv-ui from a vetted release locally and run the commands yourself rather than using npx to fetch on-demand.
Capability Analysis
Type: OpenClaw Skill
Name: osv-ui
Version: 1.0.1
The osv-ui skill is a security auditing tool designed to scan projects for CVEs using the osv-ui package via npx. The instructions in SKILL.md outline a transparent workflow involving scanning, generating reports, and applying fixes only after explicit user confirmation, with no evidence of data exfiltration, obfuscation, or malicious intent.
Capability Assessment
Purpose & Capability
The skill is a CVE/audit helper and its SKILL.md shows exactly the commands you'd expect (npx osv-ui, parse JSON, show fixes). However the metadata declares no required binaries while the instructions assume node/npm/npx are available; that's a minor inconsistency but not malicious.
Instruction Scope
Instructions stay on-task: scan projects, export JSON, open a dashboard, show fix commands, and re-scan after applying fixes. The skill explicitly requires user confirmation before applying changes. It does not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
There is no install spec (instruction-only). Runtime use relies on npx which will fetch and execute code from the npm registry if not installed locally — this is normal for this use case but carries the usual risk of executing remote package code.
Credentials
The skill requests no environment variables or credentials (appropriate). Be aware that running npm/npx/npm install can implicitly use local npm config (.npmrc) or registry auth tokens present on the host; the SKILL.md does not acknowledge that, so credentials could be used by those commands even though not requested.
Persistence & Privilege
The skill is not always-enabled, does not request persistent privileges, and does not modify other skills or global agent configuration. It is user-invocable and can be run autonomously by the agent (default), which is normal.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install osv-ui - After installation, invoke the skill by name or use
/osv-ui - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- SKILL.md substantially rewritten for conciseness and clarity.
- "How it works" section condensed; lengthy step-by-step detail removed.
- Instructions and workflow streamlined into 5 main steps.
- Activation triggers, key commands, and usage notes presented in a simpler format.
- Quick reference and notes retained with clearer examples.
- No code or feature changes; documentation-only update.
v1.0.0
Initial release of osv-ui security auditing skill.
- Enables scanning for CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui.
- Launches an interactive visual dashboard for human review of scan results before any fixes.
- Automates detection of manifest files and guides users through the audit, review, and remediation workflow.
- Only applies fixes after explicit user confirmation, showing all commands and changes in advance.
- Runs all analysis locally for user privacy; no code is uploaded.
- Supports integration with projects using Dependabot, Snyk, or other popular security tools.
Metadata
Frequently Asked Questions
What is CVE Audit Skill?
Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human r... It is an AI Agent Skill for Claude Code / OpenClaw, with 158 downloads so far.
How do I install CVE Audit Skill?
Run "/install osv-ui" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is CVE Audit Skill free?
Yes, CVE Audit Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does CVE Audit Skill support?
CVE Audit Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created CVE Audit Skill?
It is built and maintained by toan203 (@toan203); the current version is v1.0.1.
More Skills