Security audit
Security checks for vulnerabilities and agentic risk
This vulnerability scanner largely does what it claims, but it also has under-disclosed LLM credential handling and report-generation risks that users should review before installing.
Review and disable or constrain the LLM ecosystem detection before use, especially in workspaces with shared .env files or generic LLM credentials. Prefer explicit ecosystems, pin and hash dependencies before installing in sensitive environments, and treat generated CSV/XLSX reports as untrusted unless formula fields are sanitized.
scripts/utils/llm_ecosystem_detector.py:37Undisclosed Workspace Credential Access and Configurable Credential Egress
scripts/utils/report_generator.py:169Formula Injection in Generated Excel and CSV Reports
requirements.txt:1Unpinned and Unhashed Python Dependencies
The file pins Django to 3.2.0, and the static analysis indicates numerous published advisories affecting that version, including SQL injection and denial-of-service/resource exhaustion issues. Because this skill is specifically for open-source vulnerability scanning, shipping a dependency list with known vulnerable versions is especially risky: it may normalize unsafe versions in testing, examples, or downstream automation and could lead users to deploy or scan against insecure baselines.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
The skill description materially misrepresents behavior: it claims production vulnerability scanning, multi-source advisory lookups, report generation, and dependency-file analysis, while the analyzed implementation reportedly lacks those functions and instead performs other tasks such as testing, ecosystem classification, caching, or external lookups. This is dangerous because operators may trust the skill to perform security validation it does not actually perform, leading to false assurance, missed vulnerabilities, unreviewed data flows to external services, and use of undeclared capabilities.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
api_key: GLM API 키 (없으면 환경 변수에서 로드)
quiet: 로그 출력 여부
"""
# Load .env if available
try:
from dotenv import load_dotenv
load_dotenv(os.path.expanduser('~/.openclaw/workspace/.env'))
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Load .env if available
try:
from dotenv import load_dotenv
load_dotenv(os.path.expanduser('~/.openclaw/workspace/.env'))
except ImportError:
pass
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Answer with just the ecosystem name (one word)."""
return prompt
def _parse_response(self, content: str) -> Optional[str]:
"""LLM 응답 파싱"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'CryptoSwift': 'Swift',
'GRDB.swift': 'Swift',
'Hero': 'Swift',
'KeychainAccess': 'Swift',
'Kingfisher': 'Swift',
'Kitura': 'Swift',
'Lottie': 'Swift',
The file includes numpy==1.19.0, which is flagged with multiple security advisories. Even if this is only a sample requirements file, retaining a known-vulnerable scientific library can expose consumers to memory-safety or denial-of-service style issues in environments that process untrusted data, and it undermines trust in a security-focused skill.