Regex Playground

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may not be able to rely on the packaged metadata alone to confirm publisher identity or version history.

Why it was flagged

This packaged metadata does not match the supplied registry metadata, which lists a different owner ID, version 1.0.0, and a published timestamp. That creates minor provenance/version ambiguity, although there is no executable code or installer.

Skill content

"ownerId": "openclaw", "version": "0.1.0", "publishedAt": null

Recommendation

Verify the skill’s registry publisher if provenance matters, and the maintainer should align _meta.json with the published registry metadata.