Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Open Cve Scanner
v1.0.1오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce...
⭐ 0· 290·2 current·2 all-time
by@rebugui
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (CVE scanner across NVD/OSV/GitHub) matches the included code and scripts (cve-scanner.py, cve_sources/*, utils/*). Optional API key usage (NVD, GitHub) appears only to increase rate limits, which is appropriate for the stated purpose. There are no requested env vars or binaries that are unrelated to vulnerability scanning.
Instruction Scope
SKILL.md directs the agent/user to run the included Python CLI and optional pipelines (pip install -r requirements.txt; scripts/*.py). The instructions reference only dependency files (package.json, requirements.txt) and temporary output paths (/tmp) which are consistent with bulk scan/ground-truth pipeline behavior. There are no instructions to read unrelated system credentials, global configs, or to exfiltrate data to unexpected endpoints.
Install Mechanism
There is no install spec (instruction-only skill), but the bundle includes many Python scripts and a requirements.txt. That means installing/running the skill will require pip installing packages and executing local Python code. This is expected for this tool, but users should be aware that code will execute locally and perform network calls.
Credentials
No required environment variables are declared. SKILL.md mentions optional NVD_API_KEY and GITHUB_TOKEN to improve API rate limits — these are proportional and typical for a CVE scanner. No unrelated tokens/credentials or config paths are requested.
Persistence & Privilege
The skill does not request 'always: true' or other elevated persistence. It does create and use local files (reports in /tmp and checkpoints) as part of accuracy pipelines, which is consistent with its stated functionality and not an unexplained privilege escalation.
Assessment
This skill appears to do what it claims: aggregate CVE data from NVD, OSV, and GitHub and produce reports. Before installing or running it: 1) be prepared for the tool to make outbound network requests to NVD/OSV/GitHub (and possibly other public APIs); 2) supply API keys only if you trust the code and need higher rate limits (the keys increase rate limits but grant access only to those APIs); 3) review utils/llm_ecosystem_detector.py (if present) to see whether any LLM calls go to third-party endpoints you don't expect; and 4) run scripts in a sandbox or review them if you will scan sensitive dependency files, since pipelines write temporary output to /tmp and may perform bulk queries. Overall the skill is coherent with its stated purpose.scripts/utils/ml_version_matcher.py:47
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97fwa6qf0zjk1y4s04re1wsq182wfgv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.