Security Sentinel Ultimate

Scans a skill directory for security issues and best practices

This scanner appears to do what it claims, but take care before scanning sensitive directories: the report will include any hardcoded secrets or reconstructed strings it finds, and those results may be sent wherever the agent normally sends outputs. If you plan to scan private code, run the tool locally or in an isolated environment and review the generated Markdown output (or redact findings) before sharing. If you want extra assurance, review scanner.py yourself to confirm there are no unexpected network calls or exfiltration paths (none were found in the provided source).

Type: OpenClaw Skill Name: security-sentinel-ultimate Version: 0.3.0 The skill is a security scanner that uses Python's AST module in `scanner.py` to detect dangerous coding patterns, hardcoded secrets, and obfuscation techniques. While the code logic is well-implemented and aligned with its stated purpose, the skill is classified as suspicious due to a critical shell injection vulnerability in `SKILL.md`. The `scan_skill` tool passes the user-provided `path` argument directly into a shell command (`python3 ... "{{path}}"`) without sanitization, which could allow an attacker to execute arbitrary commands by including shell metacharacters (e.g., quotes and semicolons) in the path.