Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cisco ASA Hardening
v1.0.0Generates hardened Cisco ASA firewall configurations based on security best practices and specified hardening options.
⭐ 0· 47·0 current·0 all-time
byToolWeb@krishnakumarmahadevan-cmd
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and description align with the SKILL.md and openapi.json: both describe generating hardened Cisco ASA configurations. However the SKILL.md references external service hosts (toolweb.in, api.mkkpro.com) and pricing; the registry metadata declares no required credentials or config paths. That mismatch (references to a paid API but no declared API key or primary credential) is unexpected and worth questioning.
Instruction Scope
The instructions describe calling a POST /api/asa/generate endpoint and include example request/response payloads, but they do not specify a concrete base URL in the OpenAPI servers section. The SKILL.md includes external URLs (api.mkkpro.com and toolweb.in) which implies contacting third‑party servers. The doc does not caution about excluding secrets nor limit what details (passwords, keys, sensitive topology) may be sent — so using the skill could transmit sensitive firewall data to an external party without explicit disclosure.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute; nothing is written to disk and no packages are pulled. That is low risk from an install-mechanism perspective.
Credentials
The skill requests no environment variables or credentials, which is reasonable for an instruction-only generator. However the presence of a pricing table and hosted API endpoints suggests the service likely requires an account/API key in practice — yet no primary credential or env var is declared. This omission is an inconsistency that could hide where keys must be supplied or where data is sent.
Persistence & Privilege
The skill is not always-enabled and is user-invocable; it does not request system config paths or modify other skills. It does not request persistent privileges or elevated agent-wide presence.
What to consider before installing
This skill appears to actually call an external service to generate ASA configs. Before installing or invoking it: (1) Confirm the exact base URL and API owner (toolweb.in / api.mkkpro.com) and review their privacy/security policy. (2) Ask whether an API key/account is required and why the skill metadata doesn't declare that credential. (3) Do not submit real secrets (management passwords, SNMP communities, private keys, or full internal topology) when testing — use sanitized/sample data first. (4) Prefer an on‑prem or offline generator for highly sensitive firewall configs. (5) If you decide to use it, verify TLS endpoints, minimal data collection, and retention policies with the API provider.Like a lobster shell, security has layers — review code before you run it.
latestvk977wzmh3w25405v4kgxmy2h3h83xxsz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.