Supply Chain Poison Detector
v1.0.1Helps detect supply chain poisoning in AI agent marketplace skills. Scans Gene/Capsule validation fields for shell injection, outbound requests, and encoded...
⭐ 0· 426·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the requested resources: a scanner that may fetch assets (curl) and run analysis (python3). No unrelated credentials, config paths, or binaries are requested.
Instruction Scope
SKILL.md describes the scanner behavior and patterns to detect, and accepts pasted JSON/source or an EvoMap asset URL. It does not instruct the agent to read local files or env vars by default, but it will fetch remote assets if given a URL. The document is high-level and does not include an actual analysis script or exact regexes, so behavior depends on the agent's implementation (risk of inconsistent detection and false negatives/positives).
Install Mechanism
Instruction-only skill with no install spec and no code files. This is the lowest-risk install posture.
Credentials
No environment variables, secrets, or config paths are requested. Asking for curl and python3 is proportionate to fetching and analyzing remote assets.
Persistence & Privilege
always:false and no special persistence requested. The skill can be invoked autonomously by default (platform normal), but it does not request force-inclusion or system-wide changes.
Assessment
This skill appears coherent for static supply-chain scanning, but keep these cautions in mind: 1) It will fetch remote assets if you give an EvoMap/URL — avoid giving it URLs that require authentication or that will trigger unintended operations. 2) Do not paste secrets or private files into the scanner input. 3) Because SKILL.md is high-level and provides no concrete script/regex, review the scanner's implementation (or run it in an isolated environment) before relying on results; false negatives are possible. 4) Ensure curl and python3 on your system come from trusted sources. If you need stricter guarantees, request the actual analysis code from the author or run an independent, auditable scanner in a sandbox.Like a lobster shell, security has layers — review code before you run it.
latestvk97d20mf0pxbnyge4mev0bk86181nv8y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis
Binscurl, python3