Skill Security Scanner

Security audit tool for OpenClaw skills. Scans for credential harvesting, code injection, network exfiltration, obfuscation. ALWAYS run before installing any...

This looks like a coherent local security auditor. Before running it: (1) review the shipped scripts yourself (they will execute locally and read files you point them at); (2) be aware the scanner uses broad regexes and can produce false positives—manually inspect any HIGH/CRITICAL matches; (3) confirm blocklist.txt and allowlist.txt are stored where you expect (they are in the skill directory) before trusting automatic writes; (4) note the SKILL.md advertises paid 'premium' links — unrelated to the audit functionality; (5) if you plan to run this automatically in agents, treat it like any third-party tool: run it in a trusted environment and consider code review or running in a sandbox first.

Type: OpenClaw Skill Name: skill-security Version: 1.0.1 The OpenClaw AgentSkills skill bundle is designed as a security audit tool, and its core functionality in `audit.sh` appears benign and aligned with its stated purpose. However, the `preinstall-check.sh` script contains a regex injection vulnerability: when checking `blocklist.txt` and `allowlist.txt`, it uses the `SKILL_NAME` directly as a regex pattern in `grep`. A malicious skill could be named with regex metacharacters (e.g., `.` or `*`) to potentially bypass existing blocklist entries or trick the allowlist mechanism, leading to an unintended security bypass. This is a vulnerability in the security tool itself, not evidence of intentional malicious behavior by this skill.