openclaw-upgrade

github.com/clawhub.ai/oc-upgrade
Verdict: Do not install
2 critical0 high1 medium
F
SCORE 0 / 100
$skillox install openclaw-upgradeSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade F?

score · 0 / 100

The current grade reflects 2 critical findings (any 2+ CRITs → F).

2 CRIT0 HIGH1 MED0 LOW
To reach a higher grade
  • D
    Reach Dtarget score 30

    Resolve 1 of your 2 CRIT findings — any single CRIT still keeps you at D.

  • C
    Reach Ctarget score 55

    Resolve all 2 CRIT findings.

  • B
    Reach Btarget score 75

    Resolve all 2 CRIT.

  • A
    Reach Atarget score 95

    Resolve all 2 CRIT.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-z18glpg1pnfnw0ht4l14kq6v · Thu, 28 May 2026 16:54:41 GMT · 2ms

crit
Skill references secret env var $GITHUB_TOKEN
The skill instructions reference `$GITHUB_TOKEN`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 81CWE-200
▾
79GITHUB_TOKEN=$(grep GITHUB_TOKEN ~/.openclaw/.env | cut -d= -f2)
80TARGET_VER=<目标版本，如 2026.5.12>
81curl -s -H "Authorization: token $GITHUB_TOKEN" \← references $GITHUB_TOKEN — potential credential leak
82 "https://api.github.com/repos/openclaw/openclaw/releases/tags/v${TARGET_VER}" | \
83 python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('body','')[:3000])"
crit
Skill references secret env var $GITHUB_TOKEN
The skill instructions reference `$GITHUB_TOKEN`, which contains a credential. If an attacker can lure the agent into including this in an outbound URL or message, the credential leaks.
rule: env-var-harvestingline: 101CWE-200
▾
99```bash
100GITHUB_TOKEN=$(grep GITHUB_TOKEN ~/.openclaw/.env | cut -d= -f2)
101curl -s -H "Authorization: token $GITHUB_TOKEN" \← references $GITHUB_TOKEN — potential credential leak
102 "https://api.github.com/repos/openclaw/openclaw/releases/tags/v${TARGET_VER}" | \
103 python3 -c "
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/openclaw-upgrade