NIST CSF Mapper

Map your security controls and tools to NIST CSF 2.0, receive coverage scores, gap analysis, tier rating, regulatory crosswalk, and a prioritized improvement...

This skill appears to be a thin wrapper around an external API (portal.toolweb.in) that will receive detailed information about your security posture. Before installing or using it: 1) Confirm the provider identity and homepage/source (metadata lists none). 2) Do not send production-sensitive or confidential data until you verify the vendor's security/privacy policies and TLS ownership. 3) Ask the publisher why no credential is declared in the metadata even though SKILL.md requires an API key; require that the skill declare a primary credential or prompt for it explicitly. 4) Test with synthetic or redacted data first. 5) If you must provide an API key, use least-privilege credentials and short-lived keys where possible and review audit logs for API use. 6) If you need an on‑premise or offline mapping for compliance reasons, prefer tools that run locally rather than outsourcing security posture data to an external service.

Type: OpenClaw Skill Name: toolweb-nist-csf-mapper Version: 1.0.0 The skill is designed to collect and transmit highly sensitive organizational security architecture data—including specific security tools (e.g., CrowdStrike, Palo Alto, Splunk) and internal control gaps—to an external third-party API (portal.toolweb.in). While this behavior is aligned with the stated purpose of NIST CSF mapping, the aggregation of such detailed reconnaissance-grade information by an external service poses a significant security risk. There is no evidence of intentional malice or unauthorized local file access, but the inherent risk of data exposure justifies a suspicious classification.