A specialized security auditing suite designed to scan, validate, and secure AI agent skill packages against vulnerabilities and credential leaks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install agent-skills-tools
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install agent-skills-tools using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Agent Skills Security Tools?
The Agent Skills Tools package provides a critical security layer for developers and users within the AI coding agent ecosystem. As the popularity of third-party integrations grows, this tool ensures that any Openclaw Skills you install are free from malicious code or accidental security flaws. It specifically targets common attack vectors such as hardcoded API keys and unauthorized system file access.
By providing a standardized way to audit skill packages, this tool helps maintain the integrity of your local development environment. Whether you are building your own skills or utilizing community-sourced Openclaw Skills, these tools help verify that best practices—like environment variable usage and proper git history hygiene—are strictly followed.
Agent Skills Security Tools Use Cases
- Auditing third-party skill packages before local installation to prevent credential theft.
- Validating your own Openclaw Skills against security standards before sharing them with the community.
- Scanning repository history for accidentally committed secrets or sensitive tokens.
- Enforcing security compliance within teams developing custom AI agent tools.
How Agent Skills Security Tools Works
- The user points the security audit script to a specific directory containing an AI skill.
- The tool runs a comprehensive scan for hardcoded patterns identifying API keys, tokens, and passwords.
- It executes a directory traversal check to ensure the skill does not attempt to access sensitive paths like ~/.ssh or ~/.aws.
- The script analyzes the project's Git history to ensure no legacy secrets remain in the version control system.
- A detailed security audit report is generated, highlighting pass/fail statuses for critical safety checks.
Agent Skills Security Tools Setup
To get started with securing your Openclaw Skills, ensure the audit script is executable:
# Navigate to the tools directory
chmod +x skill-security-audit.sh
# Run the security audit on a skill package
./skill-security-audit.sh path/to/your/skill
Agent Skills Security Tools Data Schema & Taxonomy
The security tools organize audit results based on the following taxonomy:
| Check Type | Target | Objective |
|---|---|---|
| Credential Leaks | Codebase & Git | Identifies hardcoded keys, passwords, and tokens. |
| Path Security | File System | Flags unauthorized access to config and SSH directories. |
| Network Usage | Source Code | Detects external network calls for review. |
| Env Compliance | Configuration | Ensures credentials are read from environment variables. |
| Metadata | .json files | Validates that skill metadata follows standard protocols. |
Agent Skills Security Tools Advanced Features
- Deep Git history inspection to catch secrets that were deleted but remain in the repository commit history.
- Pattern-based detection for dangerous shell commands and unauthorized file system modifications.
- Standardized report output suitable for integration into CI/CD pipelines to automate the validation of Openclaw Skills.
- Specific checks for credentials.json file permissions to ensure sensitive data is not world-readable.
SKILL.md
Loading
Related Openclaw Skills
Poseidon OTC Skill
A trustless P2P trading protocol for Solana that enables AI agents and humans to execute atomic token swaps through secure on-chain escrow.
TikTok Scraping with yt-dlp
A comprehensive command-line framework for automated TikTok video downloading, profile crawling, and metadata extraction.
zh-knowledge-manager
A powerful AI-enhanced system for converting unstructured agent logs into structured, searchable Chinese knowledge bases.
Draw.io Diagram Generation
Automatically generate and export professional-grade architectural, database, and process diagrams directly from your AI agent.
SIGNL4 Alert Management
A specialized skill designed to automate the sending and resolving of SIGNL4 alerts via inbound webhooks to streamline incident response.
Tilt Protocol
Tilt Protocol allows AI agents to manage self-custodied investment vaults holding tokenized synthetic stocks on the Robinhood L2 network.
Featured*
