Scopecheck

Analyze an OpenClaw SKILL.md and extract its permission scope — what env vars, CLI tools, filesystem paths, and network URLs it accesses. Compares declared r...

This skill appears coherent and low-risk: it runs a local FastAPI/uvicorn server and analyzes SKILL.md text you send it. Before installing or running it, consider: (1) start it locally or in a sandboxed environment so the server only binds to localhost/your network; (2) ensure pip installs are from PyPI and consider pinning package versions; (3) the SKILL.md metadata omits 'uvicorn' from declared bins even though the example invokes it — this is a documentation/metadata omission, not an active risk; (4) the README examples use curl and jq (not declared) — you only need those to follow the example, not for the skill internals; (5) the extractor regexes may over-match in edge cases (e.g., uppercase tokens that are not intended env vars), so review results before acting on them. If you want higher assurance, review the source files provided or run the server in an isolated environment.

Type: OpenClaw Skill Name: scopecheck Version: 1.0.0 The 'scopecheck' skill is a static analysis utility designed to audit OpenClaw SKILL.md files for resource usage. It extracts and compares declared vs. detected environment variables, CLI tools, filesystem paths, and URLs using standard Python libraries (FastAPI, PyYAML, Pydantic). The code in scopecheck/app.py and scopecheck/extractors.py is transparent, follows its stated purpose, and contains no indicators of malicious behavior, data exfiltration, or intentional vulnerabilities.