Picoclaw-only local posture-review skill focused on read-only findings and safe operator remediation guidance.

This package appears coherent and read-only: it only parses the JSON profile file you explicitly pass and prints findings. Before installing, verify the package source (homepage/owner) and license (AGPL implications for redistribution). Run the included unit test locally (node test/self_pen_test.test.mjs) to confirm behavior. Note the README references a python validation script that isn't packaged—ignore or supply your own validator. Most importantly, only point --profile at files you intend to inspect (do not feed it arbitrary sensitive files), and review the small JS files yourself if you want to be certain they only read and summarize the profile. If you need stronger guarantees, run the CLI in a sandboxed environment or with a copy of the profile that has secrets redacted.

Type: OpenClaw Skill Name: picoclaw-self-pen-testing Version: 0.0.1 The skill is a local security auditing tool designed to perform read-only posture reviews of Picoclaw configuration profiles. The code in lib/self_pen_test.mjs and scripts/self_pen_test.mjs purely analyzes JSON input for security weaknesses (e.g., disabled authentication or exposed interfaces) and outputs a report. There is no evidence of network egress, data exfiltration, or malicious execution; the behavior is entirely consistent with the documentation provided in SKILL.md and skill.json.