OpenClaw Docs

PassAudited by VirusTotal on May 2, 2026.

Overview

Type: OpenClaw Skill Name: jszesze-openclaw-docs Version: 1.0.0 The skill is a documentation helper designed to fetch, cache, and search markdown files from 'docs.openclaw.ai'. It uses standard shell utilities (curl, grep, awk, perl) to manage a local documentation index and track changes over time. The code logic is transparent, lacks obfuscation, and contains no evidence of data exfiltration or malicious execution; all network activity is directed toward the legitimate documentation domain specified in scripts/lib.sh.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If directed to a non-OpenClaw URL, the skill could fetch and print content from another HTTP endpoint instead of only the intended documentation site.

Why it was flagged

The fetch helper accepts full http(s) URLs and downloads them. This is useful for docs URLs, but it is not domain-restricted in code.

Skill content
if [[ "$input" =~ ^https?:// ]]; then ... curl -fsSL "$url" -o "$tmp"
Recommendation

Use this skill only with docs.openclaw.ai paths or URLs, and consider adding a domain allowlist if publishing a stricter version.

What this means

Users cannot easily compare this package against an official upstream repository or homepage before installing.

Why it was flagged

The registry metadata does not provide an upstream source or homepage, so users have less provenance context even though the included scripts are present for review.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Prefer a version with a clear source repository/homepage, or review the included scripts before use.