Skill Audit Guardian

• Analyzed: May 11, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.0
• Hash: f9515f5ae16690651bf0d254478985f5cb201db806af6d3db29014b5114f73c2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for security auditing, but contains significant operational vulnerabilities. Specifically, `scripts/skill-zip-watch.sh` and `scripts/generate-skill-audit-pro.py` use hardcoded absolute paths (e.g., `/Users/gascomp/.openclaw/workspace/...`, `/Users/gascomp/Desktop/...`) for internal script calls and output files. This makes the skill non-portable and prone to failure or unintended behavior if deployed in a different environment or by a different user, as these paths may not exist or could be controlled by an attacker in a specific scenario. While the intent of the skill is benign (to detect malicious patterns in other ZIPs), these hardcoded paths represent a critical flaw in its design and deployment reliability.