Od Tool

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If the agent or user points the tool at a private file, that file's bytes may be exposed in the conversation output.

Why it was flagged

The script opens and reads the path supplied by the user or agent. This is expected for a file dump utility, but it means sensitive files would be printed if selected.

Skill content

data=open(sys.argv[1] if len(sys.argv)>1 else sys.stdin.read(),'rb').read()

Recommendation

Use it only on files you intentionally want inspected, and verify the file path before running it.

NoteHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

The tool may fail or produce unexpected output when used according to the documented examples.

Why it was flagged

The documentation advertises multiple output modes, but the included script only prints octal bytes and does not parse these options.

Skill content

- `-x`: Hexadecimal output
- `-d`: Decimal output
- `-c`: ASCII character display
- `-A`: Select address base

Recommendation

Treat this as a basic octal-only dump script unless the implementation is updated to match the documentation.