Senior Secops

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST sc...

This skill appears to implement the advertised SecOps capabilities, but verify these before installing or running it on sensitive data: - Ensure a Python runtime (3.x) and any required libraries are available — SKILL metadata does not declare Python as a required binary. - Inspect the three included scripts locally for any network calls or credential usage (look for fetch_nvd_data, HTTP requests, or use of API tokens) before running them in production. - Do not run the scanner over system-wide or credential-containing directories unless you want secrets discovered; consider scanning a copy or limiting the target path. - The docs show CI integrations that expect tokens (SNYK_TOKEN, etc.). If you integrate with third-party services, only provide the minimum-scoped secrets via your CI secret store. - Because some functions shown in references look like placeholders or rely on external integrations, test the tool in a sandbox and confirm its outputs and failure modes before relying on it for audit or blocking CI pipelines. If you want, I can (1) summarize any network/IO calls found in the actual script files, (2) list external Python packages the scripts import that may need installation, or (3) highlight exact lines where the scanner detects credential patterns so you can review them.

Type: OpenClaw Skill Name: senior-secops Version: 2.1.1 The 'senior-secops' skill bundle is a comprehensive and legitimate security operations toolkit designed for local auditing and compliance verification. It includes Python scripts (security_scanner.py, vulnerability_assessor.py, and compliance_checker.py) that use regular expressions to identify common vulnerabilities like hardcoded secrets, SQL injection, and XSS, as well as checking dependencies against a local CVE database. The code is well-documented, follows secure coding practices itself, and contains no evidence of data exfiltration, malicious execution, or harmful prompt injection instructions.