Is lxgicstudios/secret-scanner safe?
Use with caution. lxgicstudios/secret-scanner is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the secret-scanner skill by lxgicstudios a trust score of 76/100 with 3 findings (1 critical).
https://github.com/openclaw/skills/tree/main/skills/lxgicstudios/secret-scanner
Is lxgicstudios/secret-scanner safe to install?
This secret scanner tool performs its stated function but has a critical flaw: it sends detected secrets to OpenAI for analysis, creating a data exfiltration risk. While the tool's core purpose is legitimate, users should be aware that any secrets found will be transmitted to a third-party API.
What security issues were found in lxgicstudios/secret-scanner?
Category Scores
Findings (3)
CRITICAL Secrets sent to external API -50 ▶
The tool sends detected secrets to OpenAI's API for analysis via the aiAnalyze function. This means any secrets found in the user's codebase are transmitted to a third-party service, creating a significant data exfiltration risk.
MEDIUM Access to sensitive files -10 ▶
The tool accessed sensitive files including .env, SSH private keys, and AWS credentials. While expected behavior for a secret scanner, this creates risk if the tool is malicious.
LOW External URLs in documentation -5 ▶
The SKILL.md contains external URLs to social media and websites which could theoretically be used for redirection attacks.
Should I install lxgicstudios/secret-scanner?
Oathe's verdict for lxgicstudios/secret-scanner is CAUTION with a trust score of 76/100. Recommendation: Review before install.