Skill Security Reviewer 3.0

Detects malicious behavior and security threats in target skills using advanced analysis of obfuscation, encoding, encryption, and dynamic code techniques.

This skill appears to do what it says (read-only analysis of other skills) but the SKILL.md contains at least one prompt-injection pattern. Before installing: (1) manually inspect the entire SKILL.md for any instructions that try to override agent constraints (phrases like 'ignore previous instructions' or embedded 'execute' directives); (2) only run it in a sandboxed agent environment where it cannot access unrelated files or credentials; (3) ensure the agent enforces the 'do not execute decoded code' rule programmatically (not just by prose); (4) if you plan to allow autonomous invocation, consider disabling that until you've audited behavior; (5) if you need more assurance, ask the maintainer for provenance (homepage, source repo, maintainer identity) or run the analysis locally on a copy of the target skill rather than giving the skill access to live system state. Additional information that would change this assessment: presence of embedded instructions in SKILL.md that explicitly tell the agent to execute code or access unrelated credentials, or bundled install scripts/downloader entries — those would raise the severity to malicious.

Type: OpenClaw Skill Name: skill-security-reviewer Version: 3.0.0 The skill 'skill-security-reviewer' is designed to detect malicious skills, a benign objective. Its `SKILL.md` explicitly forbids the agent from executing any commands or scripts from the target skill or executing decoded code (Section §3, 'Execution Rules'). However, the skill requires broad file system access to read and analyze all files of a target skill, including potentially sensitive configurations and code. This constitutes a 'risky capability' (broad permissions, processing untrusted input) even though it is plausibly needed for its stated purpose. The inherent risk of processing and decoding potentially malicious content, combined with broad file access, creates a vulnerability surface for the agent or its environment, leading to a 'suspicious' classification rather than 'benign' or 'malicious'.