A comprehensive behavioral security scanner and auditor designed for AI agent skills and MCP tools.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install aegis-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install aegis-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Aegis Audit?
Aegis Audit serves as a defensive security auditing layer for the AI ecosystem. It is designed to answer the fundamental question of whether a tool can be trusted by performing deterministic static analysis, AST parsing, and secret scanning. By providing a clear view of exactly which files, URLs, and system resources a skill can access, it allows developers and users to vet code before execution.
As a critical tool for maintaining the integrity of Openclaw Skills, Aegis replaces basic safety summaries with full CWE-mapped and OWASP-tagged security reports. It ensures that every skill added to an agent's repertoire is verified against malicious patterns, providing a cryptographic proof of security that acts like an SSL certificate for your AI tools.
Aegis Audit Use Cases
- Auditing third-party AI agent skills before local installation to prevent data exfiltration.
- Generating signed security lockfiles for developers publishing their own Openclaw Skills.
- Automating security gates in CI/CD pipelines to block dependencies with high risk scores.
- Verifying the integrity of installed tools to ensure no unauthorized modifications have occurred.
How Aegis Audit Works
- The user runs a scan on a target directory using the aegis CLI to begin the discovery process.
- Aegis utilizes over 15 specialized scanners, including AST parsers and Semgrep rules, to analyze the codebase for dangerous patterns.
- The tool resolves the actual capabilities of the skill, identifying specific filesystem and network access points.
- A composite risk score (0-100) is calculated based on findings mapped to the CWE and OWASP frameworks.
- (Optional) If configured, an LLM provides an intent-based second opinion on the code's behavior.
- A signed aegis.lock file is generated, creating a cryptographic snapshot for future verification.
Aegis Audit Setup
Install the auditor directly from PyPI using pip:
pip install aegis-audit
Alternatively, use uv for a tool-based installation:
uv tool install aegis-audit
To configure your environment and optional LLM providers for scanning Openclaw Skills, run the interactive setup:
aegis setup
Aegis Audit Data Schema & Taxonomy
Aegis generates structured security reports and lockfiles to govern the lifecycle of Openclaw Skills. The data is organized as follows:
| Component | Format | Description |
|---|---|---|
| Deterministic Payload | JSON | Contains Merkle tree, capabilities, CWE findings, and static risk score. |
| Ephemeral Payload | JSON | Contains LLM-powered analysis and non-deterministic risk adjustments. |
aegis.lock |
Signed File | An Ed25519-signed snapshot for tamper detection. |
config.yaml |
YAML | Global configuration and API keys stored in ~/.aegis/. |
Aegis Audit Advanced Features
- Built-in MCP Server for seamless integration with Cursor and Claude Desktop workflows.
- Cryptographic Ed25519 signing for tamper-proof verification of Openclaw Skills.
- Vibe Check personas that categorize code quality and trust levels (e.g., Permission Goblin, The Snake).
- Local LLM support via Ollama or LM Studio for privacy-focused intent analysis.
- Multi-capability attack chain detection via the Combo Analyzer.
SKILL.md
Loading
Related Openclaw Skills
OpenProof Agent Skill
A professional-grade client for AI agents to register, publish, and manage research findings within the OpenProof registry.
image-process
A comprehensive image processing utility for automated background removal, intelligent upscaling, and high-performance compression.
Trading Signals
A quantitative trading signal generator that analyzes market trends using multiple technical indicators for stocks and cryptocurrencies.
Stock & Crypto Real-time Monitor (HK/US/Crypto)
A technical analysis tool for real-time monitoring of Hong Kong stocks, US stocks, and cryptocurrencies using Yahoo Finance.
Server Health Agent
A production-ready monitoring skill for tracking real-time server metrics and Docker container status.
Keywords Everywhere SEO Research
A CLI-powered SEO toolset for keyword research, competitor analysis, and backlink tracking using the Keywords Everywhere API.
METADATA
Featured*
