Paprika Recipe Importer

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently creates Paprika recipe import files from user-provided recipe content, with only low-risk local file generation and script execution needed for that purpose.

This appears safe for its stated purpose. Before installing, note that it runs a local Python script and writes recipe files, so use it with recipe content you are comfortable saving into a Paprika import file.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

The agent may create a temporary JSON file and run the helper script locally to produce the Paprika import file.

Why it was flagged

The skill instructs the agent to run an included Python script to package the recipe file. This is purpose-aligned and scoped, but users should know the skill performs local command execution.

Skill content

python3 ~/.openclaw/skills/paprika-recipe-importer/scripts/build_paprikarecipes.py \
  /tmp/<recipe-name>.json \
  /tmp/<recipe-name>.paprikarecipes

Recommendation

Use normally if you are comfortable with local file generation; review the generated recipe content before importing it into Paprika.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or behave differently on systems without Python 3 available.

Why it was flagged

The metadata does not declare a Python requirement, while the SKILL.md workflow invokes python3. This is an operational metadata gap rather than evidence of hidden behavior.

Skill content

Required binaries (all must exist): none

Recommendation

Ensure Python 3 is available before using the skill, or ask the publisher to declare the runtime requirement.