S³ Security Audit

Run security audits on codebases using static analysis, dependency scanning, and manual code review patterns. Covers OWASP Top 10, secrets detection, depende...

This instruction-only skill mostly does what it claims (local static checks and dependency scans), but note two important caveats: (1) the registry metadata omits required binaries (grep/find/sed, npm, pip), so ensure the executing environment has those tools before use; (2) the SKILL.md will try to install tooling at runtime (e.g., 'pip install pip-audit') and run network queries (npm audit/pip-audit), which introduces supply-chain and network exposure risks. Before installing or running: run the commands manually or inside an isolated container/VM, review and pin any packages that would be installed, avoid running against repositories with live secrets unless in a controlled environment, and consider using curated, signed scanner binaries or your organization's approved security tools instead of allowing implicit installs.

Type: OpenClaw Skill Name: s3-security-audit Version: 1.0.0 The skill bundle provides a comprehensive set of instructions and shell commands for performing static security audits on codebases, including secrets detection, dependency scanning, and vulnerability pattern matching using grep. The logic is transparent, uses standard security tools (like pip-audit and npm audit), and aligns perfectly with its stated purpose without any signs of data exfiltration, malicious execution, or prompt injection.