Neckr0ik Security Scanner

Security audit tool for OpenClaw skills. Scans skill directories for common vulnerabilities including hardcoded secrets, unsafe shell commands, prompt inject...

This skill appears to be a legitimate local security scanner. Before installing or running it: (1) Review the audit.py source yourself to confirm it does not perform network requests that would exfiltrate reports (the provided code appears to only scan files, but a final truncated section should be inspected); (2) note the claw.json name mismatch ("skillguard") — ask the author if that concerns you; (3) run the tool locally on a non-production copy of skill directories to see its output and ensure reports are stored locally (or explicitly review where --format outputs are written) before using it in CI; (4) if you will let an agent invoke it autonomously, be comfortable with the agent reading installed-skill files (it will scan potentially sensitive repos and configuration files). If you want extra assurance, run it in an isolated environment (container/VM) and grep the code for any network calls or subprocess invocations that could contact external domains.

Type: OpenClaw Skill Name: neckr0ik-security-scanner Version: 1.0.0 The neckr0ik-security-scanner is a legitimate static analysis tool designed to audit OpenClaw skills for security vulnerabilities. The core logic in scripts/audit.py uses regular expressions to detect hardcoded secrets, shell injection risks, and suspicious network activity, while the documentation in the references/ directory provides helpful remediation advice. No evidence of data exfiltration, malicious execution, or prompt injection attacks was found; the tool functions exactly as described in its manifest and documentation.