claw-security-panel

This skill largely does what it says (local security checks and a temporary web panel), but several red flags deserve attention: - Missing runtime declarations: start.sh and the script call external commands (openclaw, last, sudo, curl, git) though the registry metadata lists no required binaries. Expect failures or hidden prompts for sudo. Ensure these tools and privileges are acceptable before running. - Reads sensitive data: the script reads /var/log/auth.log, runs last, and scans your workspace for plaintext secrets. That is appropriate for a security scanner, but you should only run it on systems you control and after making backups. - Dynamically generated server: start.sh launches /tmp/security_panel_server.py which is not part of the published files. The security_check.py likely writes and then executes a server script — code executed from /tmp is not visible in the manifest and could perform additional actions (network calls, exfiltration). Before running, inspect the runtime-generated /tmp/security_panel_server.py and /tmp/security_report.json to ensure they contain only the expected server and HTML content. - Auto-fix behavior: the tool can perform 'one-click' fixes (file permissions, modifying config.json). Review suggested fixes and back up affected files before applying automated fixes. - Recommended mitigations: run this skill in an isolated environment (VM/container) first, examine the generated /tmp files before execution, ensure you have recent backups, and run with minimal necessary privileges (avoid running as root). If you want to proceed, ask the publisher for the server code (the file created in /tmp) and full script contents (untruncated) so you can review all runtime behavior. If you cannot inspect the generated server, do not run it on production hosts.