CVE Audit Skill
v1.0.1Security auditing skill for scanning CVE vulnerabilities across npm, Python, Go, and Rust projects using osv-ui. Opens a visual browser dashboard for human r...
⭐ 0· 94·0 current·0 all-time
by@toan203
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill is a CVE/audit helper and its SKILL.md shows exactly the commands you'd expect (npx osv-ui, parse JSON, show fixes). However the metadata declares no required binaries while the instructions assume node/npm/npx are available; that's a minor inconsistency but not malicious.
Instruction Scope
Instructions stay on-task: scan projects, export JSON, open a dashboard, show fix commands, and re-scan after applying fixes. The skill explicitly requires user confirmation before applying changes. It does not instruct reading unrelated system files or exfiltrating data.
Install Mechanism
There is no install spec (instruction-only). Runtime use relies on npx which will fetch and execute code from the npm registry if not installed locally — this is normal for this use case but carries the usual risk of executing remote package code.
Credentials
The skill requests no environment variables or credentials (appropriate). Be aware that running npm/npx/npm install can implicitly use local npm config (.npmrc) or registry auth tokens present on the host; the SKILL.md does not acknowledge that, so credentials could be used by those commands even though not requested.
Persistence & Privilege
The skill is not always-enabled, does not request persistent privileges, and does not modify other skills or global agent configuration. It is user-invocable and can be run autonomously by the agent (default), which is normal.
Assessment
This skill appears to do what it claims: run osv-ui via npx, show a dashboard, and propose fixes. Before using it, ensure you: (1) have Node/npm and npx available or adjust the instructions; (2) understand that npx will fetch and execute code from the npm registry — review or pin the osv-ui package source/version if you require higher assurance; (3) run scans in an isolated environment (container/VM) if you're worried about executing remote code or exposing local registry credentials; (4) verify the skill asks for explicit confirmation before it runs npm install (it does in SKILL.md); and (5) check for sensitive tokens in your .npmrc or environment that npm/npx could use. If you want lower risk, install osv-ui from a vetted release locally and run the commands yourself rather than using npx to fetch on-demand.Like a lobster shell, security has layers — review code before you run it.
latestvk977gefva4vd7yv018sy4q0ekx83bxhe
License
MIT-0
Free to use, modify, and redistribute. No attribution required.