Security Testing Agent

安全测试Agent。漏洞扫描、渗透测试、代码审计、安全加固。触发词：安全、渗透、漏洞、xss、sql注入、csrf、扫描、审计。

This skill appears coherent for its stated purpose, but it performs active scans and includes potentially destructive payloads. Before installing or using it: 1) Only run scans against systems you explicitly have permission to test; unauthorized scanning may be illegal. 2) Review the full SKILL.md and any referenced repository (skill.json points to a GitHub URL) to confirm the author and intent—the registry metadata shows an unknown source. 3) Run the skill in an isolated/test environment (or sandbox) first to avoid accidental damage to production systems. 4) The SKILL.md references many external tools but won't install them for you—install and vet those tools yourself. 5) Do not provide credentials or tokens to the skill unless you understand and trust where they will be used; prefer ephemeral/test credentials. If you want higher assurance, request the complete SKILL.md and verify there are no instructions that read or exfiltrate local files or environment variables before running.

Type: OpenClaw Skill Name: openclaw-security-testing-agent Version: 1.0.0 The skill bundle provides a security testing suite in SKILL.md that includes active vulnerability scanning, secret detection, and dependency auditing. It utilizes high-risk capabilities such as executing shell commands via subprocess.run and scanning the local filesystem for sensitive credentials like AWS, GitHub, and OpenAI tokens. While these actions are consistent with the stated purpose of a security agent, the presence of destructive SQL injection payloads (e.g., DROP TABLE) and the broad access to local secrets without built-in safeguards make the bundle inherently risky, though no clear evidence of intentional data exfiltration or malicious intent was found.