Is kapishdima/dtek-light safe?
https://github.com/openclaw/skills/tree/main/skills/kapishdima/dtek-light
The dtek-light skill is a personal Playwright utility that checks electricity status at a single hardcoded address in Odessa, Ukraine against the DTEK power utility website. No prompt injection payloads, credential-harvesting instructions, or malicious code paths were found; the skill's extreme address specificity strongly indicates legitimate personal use. The main risks are the heavyweight Playwright/Chromium dependency and a mildly broad find-based script locator, neither of which constitutes an active threat.
Category Scores
Findings (6)
LOW Heavy Playwright/Chromium dependency with large attack surface -12 ▶
The skill requires downloading the full Playwright package and a Chromium browser (~200MB). While disclosed in Prerequisites and standard for browser automation, Chromium is a large, complex binary with a significant historical vulnerability surface. Users should ensure Playwright is kept up to date.
LOW Execution command uses broad find over ~/.claude/skills -10 ▶
The SKILL.md execution command uses find ~/.claude/skills -name 'check-light.js' -path '*dtek-light*' to locate the script at runtime. This searches the entire skills tree rather than using a path relative to the skill's own directory. If another skill installs a file named check-light.js in a dtek-light-like path, it could be inadvertently executed.
LOW Shell command substitution in execution instruction -6 ▶
The execution command embeds two levels of command substitution ($(...)) within double quotes. While not exploitable given the fixed search pattern, unquoted path components could cause unexpected behavior if a skill path contains spaces or special characters.
LOW Canary credential files accessed post-install (read-only, no exfiltration) -8 ▶
Six canary credential files were accessed at timestamps 1771956869.376-377, approximately 500ms after the audit framework completed its file collection pass. The skill was never executed (Playwright was not installed), so these accesses are attributable to the audit framework's own monitoring cycle rather than skill behavior. Canary integrity confirmed intact.
INFO Outbound HTTP to Ukrainian power utility website -5 ▶
check-light.js navigates to https://www.dtek-oem.com.ua/ua/shutdowns and reads plain text from the DOM. This is the intended, documented behavior. The domain is the official DTEK Odessa power utility. No user data is transmitted.
INFO Hardcoded single residential address confirms personal utility 0 ▶
The skill hardcodes вул. Чикаленка Євгена, 43 in Odessa throughout both the description and the automation script. This extreme specificity — useful only to the person living at that address — is inconsistent with tools designed for surveillance, credential harvesting, or general-purpose malicious use.