security-skiil-scanner

Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...

This skill mostly looks like a legitimate vetting checklist and quick-commands guide, but there are red flags that justify caution: - Metadata mismatches: the registry name/slug/owner differ from SKILL.md/_meta.json/README. That could be a packaging mistake or an attempt to masquerade as another skill — verify the correct author and slug before installing. - Undeclared dependency: the docs call 'clawhub install' but 'clawhub' is not listed in required binaries. Ensure you have the expected CLI tools and understand what the script will run. - Scope: the vetter tells the agent to download and 'cat' all files in a repo; that will expose any secrets embedded in the package being inspected. That is expected for vetting, but you should not run it against packages you don't trust or that might contain sensitive files. Recommended actions before installing: 1) Manually verify the skill’s source (author account, repo URL, ClawHub verified badge). Confirm ownerId/slug match the publisher. 2) Run the vetting commands yourself in a controlled environment (container or VM) rather than allowing an agent to run them autonomously. 3) Add 'clawhub' to your checklist of prerequisites if you plan to follow the SKILL.md instructions, or modify the instructions to use only declared tools. 4) If you need high assurance, refuse installation until the metadata inconsistencies are resolved and the publisher identity is confirmed.

Type: OpenClaw Skill Name: security-skiil-scanner Version: 1.0.0 This skill is a security vetting tool designed to help an AI agent identify malicious code, data exfiltration, and prompt injection attempts in *other* skills. While it instructs the agent to use powerful commands like `curl` and `clawhub install` (to a temporary directory), these actions are explicitly for the purpose of analyzing external skills, not for self-exploitation or malicious behavior by this skill itself. The `SKILL.md` clearly outlines red flags to look for and provides examples of malicious code as illustrations, not as code to be executed by the vetting skill. Its purpose is to enhance security, not compromise it.