Skill Security Scanner

Automatically scans Python skill code to detect security risks like malicious patterns, hardcoded secrets, dangerous functions, and integrates VirusTotal sca...

This package appears to implement what it advertises: a local Python static scanner with an optional VirusTotal step. Before installing or running it: 1) Inspect install.sh (it symlinks source/cli.py into ~/.local/bin — make sure that path is acceptable and that you know where the repo will live). 2) Review the implementation of _scan_with_virustotal (truncated in the provided files) if you plan to enable VirusTotal to confirm it only calls VirusTotal and handles the API key safely. 3) Run the tool against a test directory first (not production code) to see outputs and confirm it doesn’t contact unexpected endpoints. 4) Be aware the scanner will read all files under the supplied skill_path (it also scans some non-Python text files and config files), so point it only at directories you intend to scan. 5) Because the registry metadata omitted an install spec while the package contains an installer, prefer manual inspection and manual installation into a controlled location (or use a virtual environment) rather than blindly running the install script.

Type: OpenClaw Skill Name: skill-secure-checker Version: 0.1.0 The skill is a legitimate security scanning tool designed for static analysis of Python code and configuration files. It identifies dangerous functions (e.g., eval, exec, os.system), hardcoded secrets (API keys, tokens), and insecure communication patterns. The implementation in source/scanner.py uses the Python 'ast' module for safe structural analysis and standard regex for secret detection. The installation script (install.sh) and CLI entry point (source/cli.py) follow standard practices for local tools, and no evidence of data exfiltration, malicious execution, or prompt injection was found.