Shadows Security Scanner

7-phase security audit pipeline — reconnaissance, dependency scan, application tests, API security, hardening check, OWASP verification, report. Use before p...

This skill appears coherent for running a repo-focused security audit. Before running it: (1) verify the skill source (registry metadata shows an external homepage in SKILL.md but the package's declared homepage is missing — confirm authenticity); (2) run scans only in the intended repository or an isolated clone to avoid accidentally scanning unrelated files on the machine; (3) be aware dependency auditors (npm audit, pip-audit, cargo-audit) make read-only network calls to vulnerability databases; (4) outputs (git history, grep results) can contain secrets — treat reports carefully and rotate any exposed secrets; (5) if you are uncertain, run the suggested commands manually in a controlled environment first rather than giving the agent autonomous execution access.

Type: OpenClaw Skill Name: shadows-security-scanner Version: 1.1.0 The skill provides a comprehensive security audit pipeline using high-risk capabilities such as broad file system access, shell command execution, and outbound network requests. It utilizes `grep` and `git log --all -p` to scan source code and history for secrets, and invokes external tools like `npm audit` and `curl` for dependency and header checks. While these actions are clearly aligned with the stated purpose of a security scanner and no evidence of malicious intent or data exfiltration was found, the combination of shell access and network capabilities meets the threshold for a suspicious classification under the provided guidelines.