Security audit

skilled-openclaw-advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says (builds and queries a local FTS5 index), but there are multiple inconsistencies and surprises (undeclared dependency on the openclaw/npm CLI, contradictory README/metadata about always:true, and claims of 'no network calls' while invoking external CLIs) that a user should understand before installing.

This skill appears to be a local documentation indexer and query tool, but before installing: 1) Inspect and run the included scripts manually (python3 scripts/build_index.py and scripts/query_index.py) in a terminal to see their prompts and errors. 2) Be aware the scripts call external binaries (npm, which, openclaw) that are not declared as required; if those CLIs are present they will be invoked — and the openclaw CLI may perform network operations depending on its implementation. 3) Note the SKILL.md/README contain contradictory claims (e.g., 'no network calls' and 'does not read openclaw.json' vs. the code that does). 4) If you want strict guarantees, run build_index.py in a sandbox or inspect openclaw.json and the code yourself; ensure the openclaw CLI behavior is acceptable (or avoid running the parts that invoke it). 5) Prefer the maintainer to: a) declare npm and openclaw as required binaries if they are required, b) correct README/metadata inconsistencies (always flag and runtime behavior), and c) clarify exactly when/if the openclaw CLI is invoked so you can opt out.

Static analysis

No suspicious patterns detected.