Vulnerability Scanner

Performs static analysis for OWASP 2025 risks, supply chain threats, secrets detection, code patterns, and prioritizes vulnerabilities by exploitability and...

This package appears to be a normal, self-contained source-code vulnerability scanner. Before running it: (1) run it on a copy of the target repository (not on a sensitive production directory), (2) be aware that it will read many files and may report secrets — treat reported results carefully, and do not leak findings to public outputs, (3) npm audit may contact the network/registry if package.json exists, so run in an environment where network activity is acceptable, (4) inspect the included script yourself if you have concerns (it uses subprocess.run and file I/O), and (5) run scans with least privilege or in an isolated container if you want to limit side effects.

Type: OpenClaw Skill Name: vulnerability-scanner Version: 1.0.0 The OpenClaw skill 'vulnerability-scanner' is classified as benign. The `SKILL.md` provides detailed, legitimate instructions for a security scanner and contains no prompt injection attempts. The core script `scripts/security_scan.py` correctly implements the stated purpose, performing static analysis for secrets, dangerous code patterns, and configuration issues within a specified project path. It uses `subprocess.run` to execute `npm audit`, which is a standard security tool, and reads files only within the designated project directory. There is no evidence of data exfiltration, unauthorized system modification, or malicious execution beyond its stated function of identifying vulnerabilities.