Skill Radar

Scan, analyze, and optimize your AI skill ecosystem. Diagnose skill usage, discover capability gaps, and check version updates in one command. Trigger on "sk...

This skill appears to do what it says: it inspects your installed Skills, reads local workspace files and session logs, queries ClawHub via npx, and writes caches under ~/.openclaw/workspace. Before installing, consider: 1) it will access sensitive conversation logs and workspace configs — only use it if you trust the skill and its source; 2) it calls external CLIs (openclaw, npx clawhub) which may contact remote services; ensure those CLIs are from trusted origins; 3) it may execute a local mem0 list.py if present — review that script before allowing it to run; 4) caches are stored in your home directory and can be removed by deleting ~/.openclaw/workspace/.skill-radar-*.json. If you want extra assurance, run it in a constrained or non-production environment first and inspect its output and created cache files.

Type: OpenClaw Skill Name: skill-radar Version: 1.1.1 The 'skill-radar' bundle acts as a diagnostic and optimization tool that performs extensive reading of sensitive local data, including conversation logs (~/.openclaw/agents/main/sessions/*.jsonl), memory files (MEMORY.md), and workspace configurations. It executes shell commands via a risky 'run_cmd' wrapper in 'scripts/utils.py' that is vulnerable to shell injection, particularly in 'scripts/scanner.py' where search queries and skill names are interpolated into command strings. While the logic (including a regex-based security scanner for other skills) aligns with its stated purpose, the combination of broad access to private data and unsafe execution patterns warrants a suspicious classification.