Security Audit

darwintree/openclaw-skills:public/imas-cd-card

github.com/darwintree/openclaw-skills

AI SkillCommit 79a91adf29fd

TRUSTED

Scanned 12 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

darwintree/openclaw-skills:public/imas-cd-card received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Suspicious import: requests, Unrestricted Server-Side Request Forgery (SSRF).

The analysis covered 4 layers: dependency_graph, llm_behavioral_safety, manifest_analysis, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 8, 2026 (commit 79a91adf). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

93%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Network Access

2 findings

Shell Execution

1 finding

Excessive Permissions

2 findings

Security Findings2

Severity	Finding	Layer	Location
HIGH	Unrestricted Server-Side Request Forgery (SSRF) The `render_cd_card.py` script accepts an arbitrary URL via the `--url` argument and performs an HTTP GET request using `requests.get` without validating the domain. This allows an attacker (or a confused agent) to force the application to access internal network resources (e.g., localhost, cloud metadata services) or arbitrary external sites. The content of the response is then processed and rendered into an image, which could allow exfiltration of sensitive internal data via the generated image. Validate the `url` parameter against a strict allowlist of trusted domains (e.g., `lantis.jp`, `idolmaster.jp`) before making the request. Ensure the resolved IP address is not a private or loopback address.	Unknown	scripts/render_cd_card.py:45
MEDIUM	Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration.	Unknown	/tmp/skillscan-clone-0o1otjo3/repo/public/imas-cd-card/scripts/render_cd_card.py:25

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/80f39aefa4602774.svg)](https://skillshield.io/report/80f39aefa4602774)