Skill Dfyx Code Security Review

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 1.0.1
• Hash: e946bd8d61a1cfa75aec361fb9a03a5b5d4301038d54823396fd79d026e56ad1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is designed as a comprehensive code security review tool. It includes Python scripts for static analysis (pattern matching, data flow, secret finding), dependency scanning (using `npm audit` and `pip audit` via `subprocess.run`), and report generation. The `vulnerability_validator.py` script generates proof-of-concept (POC) strings for various vulnerabilities (e.g., `'; cat /etc/passwd; #'`, `pickle.loads(b'cos\nsystem\n(S"whoami"\ntR.')`) but does not execute them. Extensive markdown documentation provides detailed knowledge on attack chains and POCs, which is necessary for an AI security expert to understand and report on vulnerabilities. While the tool's capabilities (file system access, external command execution for audits, generation of attack payloads) are powerful and could be misused, there is no clear evidence of intentional harmful behavior (e.g., data exfiltration, persistence, unauthorized remote control) within the skill bundle's own code or explicit prompt-injection instructions for the agent to perform malicious actions. The classification is 'suspicious' because it's a security tool with high-risk capabilities that, if improperly used or instructed by a malicious actor, could be leveraged for exploitation, but it is not inherently malicious in its design.