EvidenceOps - Forensic Evidence Management

Forensic media triage with chain of custody. Use when receiving images, videos, audio, PDFs, or documents that need evidence-grade handling, integrity verifi...

This package appears to be a legitimate forensic evidence tool, but check these before installing: - Confirm source integrity: the repository/package owner is not a known homepage; verify the npm package name and publisher, or install from the included code after review. - Resolve the metadata inconsistency: SKILL.md recommends npm install but registry metadata shows “no install spec.” Ask the publisher which install method to use. - If you plan to use S3/MinIO: configure AWS credentials via IAM roles or environment in a controlled way (avoid embedding static secrets). The skill itself doesn't declare required env vars because cloud storage is optional. - Review and test redaction and path-sanitization on non-sensitive test data to ensure they behave as described. - Review the platform permission grant for “Bash” / shell execution—this is broad and should be restricted to trusted environments. - For production, follow the SECURITY.md recommendations: channel allowlist, pairing, size limits, audit logging, and object-locked S3 buckets if using cloud storage. If you want, I can list specific files to inspect (e.g., src/drivers/s3.ts, src/utils/redaction.ts, src/utils/path.ts) or summarize their contents for deeper review.

Type: OpenClaw Skill Name: skill-evidenceops Version: 1.0.0 The OpenClaw AgentSkills skill bundle 'evidenceops' is classified as benign. It demonstrates a strong security posture with robust input sanitization (path traversal prevention, filename sanitization), cryptographic integrity verification (SHA-256, hash chain), immutability controls (read-only files, S3 Object Lock), and automatic secret/PII redaction in audit logs. The `SKILL.md` actively uses the prompt injection surface to declare security guarantees and 'NEVER' statements, which are consistently supported by the TypeScript code and comprehensive security documentation (`SECURITY.md`, `DESIGN.md`). The CI/CD pipeline (`security.yml`) further reinforces this by including secret scanning, dependency auditing, and SAST tools, indicating a proactive security development approach. There is no evidence of intentional harmful behavior or exploitation.