Threat Radar

Continuously scans Docker images, dependencies, network ports, SSL/TLS, and OpenClaw config for CVEs; alerts via WhatsApp, Telegram, or Discord.

What to consider before installing: - Ask the publisher for a homepage/source and documentation that explains how alerts are delivered (what webhook/tokens are required) and where they are stored. The skill promises WhatsApp/Telegram/Discord alerts but declares no credentials — do not assume alerts are configured automatically. - Review the remainder of threat_radar.py (the parts not shown) to confirm how it sends notifications and what network endpoints it calls. Look specifically for any hard-coded endpoints, webhook URLs, or obfuscated network calls. - Confirm what `cron-install` modifies: ask for the exact code or commands it runs. Prefer to run scans ad-hoc first rather than enabling scheduled tasks system-wide. - Because the scanner reads package manifests, Docker images, and OpenClaw config and writes logs/DB under ~/.openclaw, run it in a restricted test environment (or container) first to verify behavior and avoid exposing production credentials or sensitive files. - If you want to use alerting channels, require explicit configuration: webhook URLs or tokens should be set by you and documented; do not provide any broad credentials (SSH keys, cloud keys) unless absolutely necessary and justified. - If the publisher cannot provide source/installation clarity or the code that performs notifications, treat this skill as untrusted. What would change this assessment: seeing the full source for notification/cron-install code (showing it only uses user-supplied webhook URLs and documents cron changes), or a clear install spec that safely registers the CLI and documents required credentials would reduce the concerns.

Type: OpenClaw Skill Name: threat-radar Version: 1.0.0 The skill is classified as suspicious due to significant functional vulnerabilities and misleading claims, despite lacking direct evidence of malicious intent. The `threat_radar.py` script uses hardcoded 'mock NVD data' in its `_fetch_cve_data` method, rendering its core CVE alerting feature ineffective and contradicting the `SKILL.md`'s claim of pulling from NVD and GitHub. Additionally, the `cron-install` and `cron-remove` commands advertised in `SKILL.md` are not implemented in the Python script, indicating missing functionality. While the code uses `subprocess` and `socket` for scanning, these operations are confined to the stated purpose (e.g., `docker images`, `openssl s_client`, local port checks) and do not show signs of data exfiltration or unauthorized access. The `SKILL.md` itself does not contain any prompt injection attempts.