skill sec

Security agent that inventories installed OpenClaw skills, analyzes them for threats, and syncs results to your Clawned dashboard.

This skill appears to do what it says: it inventories installed skills and (when you explicitly run a scan) uploads selected source/config files to a Clawned server. Before installing or enabling it, consider: - Only provide CLAWNED_API_KEY if you trust the Clawned service and its privacy/security practices (default server is api.clawned.io). Review their privacy/retention policies. - 'sync' uploads only metadata (owner, slug, displayName, commit/version). 'scan --path' will upload file contents (up to 30 files, 512KB each) — do NOT run scan on arbitrary or sensitive directories (e.g., repos containing secrets). - The agent reads ~/.openclaw/openclaw.json to find extra skill directories; make sure that file does not expose unintended paths you don't want scanned. - The script stores a local state file at ~/.openclaw/clawned_agent.json (agent id, timestamps). - If you want extra caution: run a quick code review of scripts/agent.py locally, or run the agent in a constrained environment (container) or against a test CLAWNED_SERVER endpoint before using it on production data. If you have low tolerance for uploading any project files, avoid using 'scan --path' or run scans only on copies you control.

Type: OpenClaw Skill Name: skill-sec Version: 1.0.1 The skill is classified as suspicious due to its high-risk capabilities, despite being explicitly declared in the documentation. The `scripts/agent.py` file, when executing the `scan --path` command, reads the full content of other skill's source files and sends them to the external server `https://api.clawned.io`. While this is declared in `SKILL.md` as part of a security analysis feature, sending arbitrary source code to an external endpoint is a significant trust requirement and a potential data exfiltration risk if the server or skill were compromised. Additionally, the skill accesses `~/.openclaw/openclaw.json` (a `CRED-001` pattern) in `scripts/agent.py` to discover skill directories, even though it claims to only read `extraDirs` and not credentials, this still represents a sensitive file access capability.