skill-forge
Analysis
Skill Forge is mostly a skill-building helper, but its dependency-management code can run shell and package-manager commands from skill metadata without validation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
meta.requires.bins.forEach(bin => { ... checkDependency(bin) ... }); ... execSync(`which ${dependency}`, { stdio: 'ignore' });Dependency names are read from the target skill's _meta.json and interpolated into a shell command, so crafted metadata could execute unexpected shell syntax when a user runs a normal quality check.
execSync(`winget install ${dependency}`, { stdio: 'ignore' }); ... execSync(`sudo apt-get install -y ${dependency}`, { stdio: 'ignore' });The install-deps path can invoke system package managers, including sudo apt-get with -y, using dependency values taken from skill metadata without an allowlist or per-package confirmation.
Source: unknown; Homepage: none; Required binaries: none; No install spec — this is an instruction-only skill; Code file presence: 2 code file(s)
The registry metadata under-declares runnable components and provenance while the artifacts include JavaScript code and documented Node-based usage.
setInterval(() => { console.log(REMINDERS.postToolUse); }, REMINDER_INTERVAL * 60 * 1000);The OpenClaw hook schedules recurring reminders during sessions, which is disclosed but still creates ongoing behavior once the hook is enabled.