Poc Validator

Automated Vulnerability Verification and Payload Replay Probe. Dynamically executes HTTP requests and analyzes HTTP status codes/error traces (e.g., SQL Inje...

This skill behaves as advertised (it replays HTTP requests and extracts error traces), but take these precautions before installing or using it: - Ensure you have explicit authorization to test any target. The skill will send arbitrary payloads and has no built-in permission checks; misuse can be illegal. - The package does not declare runtime dependencies: you need python3 and the Python 'requests' library available where the agent runs. - The script disables TLS verification (verify=False) and will accept self-signed certs; consider modifying this if you need strict TLS validation. - Requests may include Cookie or Authorization headers and the skill prints response headers/body snippets to stdout — avoid sending sensitive credentials as part of tests or ensure logs are protected. - If you plan to run this autonomously, add operational safeguards (rate limits, allowlist of target hosts, explicit confirmation prompts) to avoid accidental scanning/exfiltration. If those conditions are acceptable and you only intend to test authorized targets, the skill is coherent with its stated purpose.

Type: OpenClaw Skill Name: openclaw-poc-validator Version: 0.1.0 The skill bundle provides a tool for replaying HTTP requests and analyzing responses for vulnerabilities like SQL injection. While the logic in 'scripts/replay.py' is functional for its stated purpose, it introduces high-risk capabilities including arbitrary network access, SSL verification bypass, and proxy support. Additionally, the command construction pattern in 'SKILL.md' (e.g., python3 scripts/replay.py --url "{URL}") presents a potential command injection vulnerability if the agent's execution environment does not strictly sanitize input parameters. No evidence of intentional malicious behavior such as data exfiltration or persistence was found.