Trending Skills

Fetches skills.sh trending rankings. Use when asking about skill rankings or popular tools.

This skill appears to do what it says: scrape skills.sh for trending rankings and optionally fetch detail pages. Before installing/run: 1) Be aware you'll be asked to install Playwright and Chromium which download browser binaries and may require system libraries—use a virtual environment or container if you prefer isolation. 2) The code will perform HTTP requests to SKILLS_BASE_URL; ensure that env SKILLS_BASE_URL is not pointed to an untrusted host (default is https://skills.sh). 3) Review or run the Python scripts locally first if you want to inspect network traffic or output; no credentials are requested. 4) Minor note: src/__init__.py contains unrelated docstring text (likely leftover) but this looks like harmless leftover metadata rather than malicious behavior.

Type: OpenClaw Skill Name: trending-skills Version: 0.1.0 The skill is classified as suspicious due to several significant vulnerabilities, despite its stated benign purpose of fetching trending skills. The primary concerns are a potential shell injection vulnerability in SKILL.md where user input for `<skill-name>` is directly passed to `python src/detail_fetcher.py`, and a Server-Side Request Forgery (SSRF) risk. The `SKILLS_BASE_URL` in `src/config.py` is configurable via environment variables, allowing `src/detail_fetcher.py` and `src/skills_fetcher.py` to fetch data from arbitrary domains if the agent's environment is compromised. Furthermore, `src/skills_fetcher.py` launches a Chromium browser with `--no-sandbox` and `--with-deps` for Playwright, which, while sometimes necessary in containerized environments, significantly reduces the browser's security posture and amplifies the impact of an SSRF or browser exploit. There is no clear evidence of intentional malicious behavior such as data exfiltration to an attacker-controlled endpoint or backdoor installation.