Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level...

This skill appears coherent and low-risk: the included Python script reads a local JSON payload (limited to 1 MB), maps finding titles to OWASP categories using simple keyword matching, and writes a local output (json/md/csv). Before installing or running it: review the script (already present) to confirm it meets your needs; test with non-sensitive sample findings because scanner outputs can contain IPs, tokens, or PII; be aware the classifier is heuristic/keyword-based and may misclassify—consider enhancing heuristics if you need higher accuracy; run it in an isolated environment if you distrust the unknown publisher (no homepage/author info is provided).

Type: OpenClaw Skill Name: cyber-owasp-review Version: 0.1.0 The skill is classified as suspicious due to a path traversal vulnerability in `scripts/map_findings_to_owasp.py`. The script accepts `--input` and `--output` file paths directly from command-line arguments without sanitization, allowing an attacker to specify arbitrary file paths (e.g., `../../../../etc/passwd`) to read or write files outside the intended working directory. While the script's core functionality is benign and there's no evidence of intentional malicious behavior (like data exfiltration or remote execution), this vulnerability could be exploited by a malicious actor or a compromised agent to achieve arbitrary file read/write.