Is isriam/claw-guru safe?
https://github.com/openclaw/skills/tree/main/skills/isriam/claw-guru
The claw-guru skill provides OpenClaw documentation assistance but introduces security risks through shell command execution and forced external URL fetching. While the skill appears legitimate and canary files remained intact, the instruction to execute system commands creates a significant attack surface.
Category Scores
Findings (4)
HIGH Shell Command Execution -50 ▶
The skill instructs the agent to execute various shell commands including 'openclaw doctor', 'tail', 'grep', and file system operations. This creates a significant attack surface for command injection or system manipulation.
MEDIUM Sensitive File Access -20 ▶
The skill instructs accessing OpenClaw configuration files and log files which may contain sensitive information including API keys, credentials, or system details.
MEDIUM Forced External URL Fetching -15 ▶
The skill contains a 'hard rule' that forces the agent to fetch external URLs before providing advice, which could be exploited if those URLs are compromised or controlled by an attacker.
MEDIUM Attack Surface Expansion -35 ▶
The combination of shell execution, external URL fetching, and sensitive file access creates multiple attack vectors that could be chained together or exploited in conjunction with other skills.