Slither Audit

Run slither static analysis on Solidity contracts. Fast, lightweight security scanner for EVM smart contracts.

This skill appears to do what it claims: run Slither on local Solidity sources and produce a report. Before installing/using it: (1) install the Slither CLI (SKILL.md suggests 'pip install slither-analyzer') from a trusted source and confirm the correct package name and version; (2) be aware the script invokes the 'slither' subprocess on files you provide — running analysis on untrusted code carries the usual risks of executing third-party tools; (3) the skill's metadata does not declare the required 'slither' binary, so ensure the binary is available on PATH; (4) review the pip package and Slither project's repository for reputation and updates. If you need an explicit install in a controlled environment, prefer installing Slither in a virtualenv or sandbox before running this skill.

Type: OpenClaw Skill Name: slither-audit Version: 0.4.0 The `slither-audit.py` script executes the `slither` command using `subprocess.run` with a user-provided `contract_path`. While `subprocess.run` with a list of arguments mitigates direct shell injection, passing user-controlled input directly to an external command introduces a potential command/argument injection vulnerability, which could lead to Remote Code Execution (RCE) if the `slither` tool or the underlying system is exploitable. This is a significant vulnerability, but there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, persistence, or explicit harmful instructions), thus classifying it as 'suspicious' rather than 'malicious'.