PCAP Analyzer

Analyze local PCAP/PCAPNG files with tshark to generate detailed network forensics reports including talkers, ports, DNS, TLS, HTTP, and anomaly summaries.

This skill mostly does what it says (local tshark-based PCAP summarization), but it has a notable misconfiguration: skill.yaml and SKILL.md prefer/require /home/tom/openclaw-tools/pcap_summary.sh — a hard-coded, user-specific path outside the skill. That means if that file exists on your system it will be executed instead of the bundled script, and you should not assume it behaves safely. Before installing or running: (1) inspect /home/tom/openclaw-tools/pcap_summary.sh if it exists on your machine and ensure you trust it; (2) prefer running the bundled scripts/analyze.sh manually to confirm behavior; (3) ensure tshark (and awk/sed) are installed and run tests on non-sensitive PCAPs first; (4) ask the publisher to fix skill.yaml to call the bundled script (not a hard-coded home path) and to declare required binaries; (5) avoid running as root and avoid providing PCAPs that contain secrets until you’ve verified the tool’s behavior. The inconsistencies could be an innocent packaging error — but treat it as suspicious until corrected.

Type: OpenClaw Skill Name: pcap-analyzer Version: 0.1.0 The skill is classified as suspicious due to its critical reliance on an external, unprovided script located at a hardcoded path (`/home/tom/openclaw-tools/pcap_summary.sh`). This dependency is explicitly stated in `SKILL.md` (as a required file), `scripts/analyze.sh` (as the preferred execution path), and `skill.yaml` (as the primary command). The actual behavior of the skill is unknown and entirely dependent on this external script, posing a significant supply chain risk and potential for arbitrary code execution if the external script is malicious or vulnerable to input injection.