Scan software bill of materials (SBOM) for known CVE vulnerabilities using Expanso Edge pipelines.

This skill appears to be what it claims: a pipeline you run with expanso-edge that posts SBOM content to the public OSV API (api.osv.dev). Before installing/using it, consider: - Your SBOM contents are sent to a third-party public API (OSV). If your SBOM contains sensitive or internal package names, treat that as potential data exposure and verify acceptability with your org. - The CLI pipeline defaults the ecosystem to "npm" for every package; results may be incorrect if your SBOM contains non-npm packages. Review/adjust the pipeline mapping if you need ecosystem inference from purl. - The MCP pipeline currently does not perform OSV lookups (it returns an empty vulnerabilities array); treat MCP mode as incomplete until you confirm it queries OSV as intended. - The skill declares an optional NVD_API_KEY (unused by the provided pipeline). If you plan to add NVD support, provide credentials only if you trust the runtime environment. - Because this is an instruction-only skill, risk comes from where you run it: ensure the expanso-edge binary you install is from a trusted source and that network access to api.osv.dev (and any deploy targets like skills.expanso.io) is permitted. If you need this behavior but want to avoid sending SBOMs externally, consider running a local OSV mirror or an offline DB backend and update the pipelines accordingly.

Type: OpenClaw Skill Name: expanso-cve-scan Version: 1.0.0 The skill's primary function is to scan SBOMs for CVE vulnerabilities using the OSV API. The `pipeline-cli.yaml` legitimately makes an HTTP POST request to `https://api.osv.dev/v1/querybatch` to perform this core function. There is no evidence of malicious intent, such as data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` to subvert the agent. The `pipeline-mcp.yaml` is functionally incomplete as it does not perform the actual scan, but this is not a security vulnerability.