OpenClaw Vulnerability Checker

OpenClaw 安全漏洞检查与配置审计工具。用于检测当前 OpenClaw 版本存在的已知安全漏洞、公网访问安全风险，对比当前版本与最新版本的差异，获取漏洞详情、风险评估、配置审计和升级建议。使用场景：(1) 用户询问"检查一下我的 OpenClaw 版本有什么安全漏洞"，(2) 用户说"检查 OpenClaw...

This skill appears to implement an OpenClaw audit tool, but it has a few red flags you should consider before running it: (1) It expects local binaries (openclaw, lsof/netstat, pfctl/iptables, etc.) and a Python environment with requests + beautifulsoup4, but the package metadata doesn't declare these requirements — verify these tools exist in your environment. (2) The scripts and instructions will run local commands that reveal process lists, open ports, and firewall rules; only run on systems you control or in an isolated environment if you're uncomfortable exposing that state. (3) If you provide a GitHub token for GHSA queries, limit its scope (no broad repo deletion/admin scopes) and treat it as sensitive. (4) Review the included scripts (get_releases.py and get_version.py) yourself — they are plain Python and network-capable; no obfuscated code was found, but ensure network calls (GitHub/NVD/CNNVD) are acceptable in your environment. If you want to proceed: run the scripts interactively (not with elevated automation), ensure required dependencies are installed in a virtualenv, and avoid giving any credentials unless necessary and scoped narrowly.

Type: OpenClaw Skill Name: openclaw-vulnerability-checker Version: 1.0.1 The skill bundle is designed as a security auditor for 'OpenClaw', but it requires the AI agent to perform high-risk system operations. Specifically, SKILL.md instructs the agent to execute sensitive commands such as 'ps aux', 'lsof', 'iptables', and 'pfctl' to inspect processes and network configurations. It also provides instructions for the agent to modify system settings via 'openclaw gateway config.patch'. While these actions align with the stated purpose of security auditing and remediation, the broad system access and the ability to alter configurations represent a significant risk profile for an automated agent, though no clear evidence of intentional malice or data exfiltration was found.