中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:2 days ago Rescan
15 /100
skill-downloader
Discover, compare, review, install, or update OpenClaw skills from trusted sources with a review-first workflow
This is a policy-focused documentation skill for discovering and managing OpenClaw skills; no executable code or malicious behavior found, though capability declarations are incomplete.
Skill Nameskill-downloader
Duration25.1s
Enginepi
✓
Safe to install
Consider adding explicit capability declarations for filesystem:WRITE and network:READ to align documentation with the implied installation and discovery workflows.

Findings 2 items

Severity Finding Location
Low
Incomplete capability declarations
The SKILL.md describes installation workflows (which require filesystem writes) and searching trusted sources (which requires network access), but does not explicitly declare these capabilities in the frontmatter.
name: skill-downloader
→ Add capability declarations: filesystem: WRITE, network: READ to frontmatter for transparency
 SKILL.md:1
Info
Documentation-only skill
This skill contains only markdown documentation files with no executable code, scripts, or dependencies.
---
→ No action needed - pure policy documentation
 SKILL.md:1
ResourceDeclaredInferredStatusEvidence
Filesystem NONE WRITE ✓ Aligned SKILL.md: 'installing or updating a skill' implies filesystem writes
Network NONE READ ✓ Aligned SKILL.md: 'search trusted sources' implies network access
Shell NONE NONE — No shell execution found
Environment NONE NONE — No environment access found
Skill Invoke NONE NONE — Skill invokes other skills via documentation only
Clipboard NONE NONE — No clipboard access found
Browser NONE NONE — No browser access found
Database NONE NONE — No database access found

File Tree

3 files · 6.7 KB · 189 lines
Markdown 3f · 189L
├─ ▾ 📁 references
│ └─ 📝 advanced-workflows.md Markdown 39L · 1.2 KB
├─ 📝 README.md Markdown 48L · 1.5 KB
└─ 📝 SKILL.md Markdown 102L · 4.0 KB

Security Positives

✓ Clear review-first workflow prevents automatic execution
✓ Explicit approval requirement before installation
✓ Trusted sources policy limits exposure to malicious packages
✓ Safety policy emphasizes inspection before writing files
✓ No executable code or dependencies found
✓ No credential access or exfiltration patterns
✓ No base64, eval, or shell injection vectors