Skill Dependency Chain Auditor

Helps audit transitive skill dependency chains in agent compositions — catching the class of risk where a skill's direct dependencies appear safe but a depen...

This skill appears internally consistent for auditing dependency chains. Before installing, confirm where it will fetch metadata from (public marketplace, vendor APIs, internal registries) and whether you need to provide credentials for private registries — the SKILL.md does not list endpoints or credential requirements. Because it uses curl and python3 at runtime, it will perform network requests and run analysis locally; if you are concerned about data leakage, run it in an environment with restricted network access or provide only limited/ephemeral credentials for private registries. If you need stronger assurance, ask the publisher for the exact data sources and a sample audit run so you can verify the tool's behavior and outputs.

Type: OpenClaw Skill Name: skill-dependency-chain-auditor Version: 1.0.0 The skill bundle describes a 'skill-dependency-chain-auditor' designed to identify vulnerabilities in transitive skill dependencies. The `SKILL.md` clearly outlines its purpose, how it works, and the types of risks it aims to detect (e.g., undeclared network capabilities, unpinned versions, trust degradation). It requires `curl` and `python3`, which are plausible tools for fetching and processing skill metadata in an auditing context. There is no evidence of prompt injection attempts against the AI agent, nor any indication of malicious intent such as data exfiltration, unauthorized execution, or persistence mechanisms. The skill's documentation consistently focuses on identifying and mitigating security risks in *other* skills, not performing them itself.