Parser
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: parser Version: 3.0.2 The 'parser' skill bundle is a functional utility for processing JSON, CSV, XML, and YAML files. The implementation in 'scripts/script.sh' uses standard tools (jq, awk, grep) and Python heredocs to perform data extraction and formatting. The script follows safe coding practices, such as using environment variables and sys.argv to pass data to Python, avoiding shell injection. While the XML parser uses the standard 'xml.etree.ElementTree' library (which has known theoretical vulnerabilities like XXE), there is no evidence of intentional malice, data exfiltration, or unauthorized network activity. The instructions in 'SKILL.md' are clear and align with the tool's stated purpose.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Some commands may fail unless python3 is available, and jq changes the JSON parsing path when installed.
The skill text discloses runtime dependencies, while the registry metadata lists no required binaries. This is purpose-aligned but may cause setup surprises.
## Requirements - python3 - jq (optional)
Confirm python3 is installed before using XML/YAML parsing, and treat jq as an optional dependency for JSON parsing.
Using the skill runs local helper code on files you provide.
The skill is designed to invoke a bundled local shell script. This is expected for a command-line parser, but it is still local code execution.
```bash scripts/script.sh json ```
Use it only on files you intend to parse, and review the bundled script if your files contain sensitive information.
Parsed content from private files could remain on disk in a local cache.
The skill discloses local caching of parse results, which may retain structured data extracted from user files.
## Data Storage Parse results can be cached in `~/.local/share/parser/`.
Avoid parsing secrets unless you are comfortable with local caching, or clear the parser cache after use.