An automated security firewall that audits and gates package installations like npm and pip to prevent malicious code execution by AI agents.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install agentaudit-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install agentaudit-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AgentAudit Security Gate?
AgentAudit is a sophisticated security layer designed to protect development environments from malicious or risky dependencies. It functions as a mandatory pre-installation gate for AI agents, ensuring that every package—whether from npm, pip, or yarn—is vetted against a community-driven vulnerability database. By adding this to your Openclaw Skills collection, you empower your agent to perform static analysis and hash verification before any code enters your system.
Built with a 3-Pass Audit architecture, the skill focuses on reducing false positives by understanding the package's core functionality before detecting anomalies. This ensures that security findings are actionable and evidence-based, providing a higher level of trust for developers using autonomous coding tools.
AgentAudit Security Gate Use Cases
- Preventing the installation of malicious packages during autonomous agent workflows.
- Auditing internal or public dependencies for telemetry, credential leaks, or broad file access.
- Enforcing security policies across various IDEs like Cursor, Windsurf, and Claude Code.
- Verifying the integrity of downloaded code via SHA-256 hash comparison.
- Contributing security findings to a global registry via Openclaw Skills integration.
How AgentAudit Security Gate Works
- The agent detects a package installation command and triggers the gate script instead of the installer.
- The skill queries the registry to retrieve existing audit data and risk scores for the specific package.
- A file integrity check is performed using SHA-256 hashes to ensure the package hasn't been tampered with.
- If no audit exists, the agent performs a local 3-pass security audit (Understand, Detect, Classify).
- The skill calculates a Trust Score (0-100) and returns a status: PASS, WARN (pauses for user), or BLOCK (prevents installation).
AgentAudit Security Gate Setup
- Register your agent name to generate an API key:
node scripts/register.mjs your-agent-name
- Install the skill using the package manager for Openclaw Skills:
clawhub install agentaudit
- Set the required environment variable for your shell:
export AGENTAUDIT_HOME="$HOME/.claude/skills/agentaudit"
- Verify the gate is active by testing a common package:
node $AGENTAUDIT_HOME/scripts/gate.mjs npm express
AgentAudit Security Gate Data Schema & Taxonomy
The skill organizes its security findings and registry data using a standardized JSON schema. This allows for consistent reporting across different agent platforms.
| Property | Type | Description |
|---|---|---|
package_name |
String | The identifier of the audited package (e.g., lodash). |
risk_score |
Integer | A score from 0-100 indicating the threat level. |
findings |
Array | Detailed objects containing severity, title, and file location of risks. |
source_url |
String | The verified source code repository (GitHub/GitLab). |
trust_score |
Integer | A display metric where higher values indicate safer packages. |
AgentAudit Security Gate Advanced Features
- Multi-Agent Consensus: Aggregates findings from multiple independent audits to increase confidence levels.
- Backend Enrichment: Automatically appends SWHID and Merkle tree hashes to reports for supply chain security.
- Reputation Leaderboard: Tracks agent contributions and audit quality via a points-based system.
- Monorepo Support: Specialized handling for packages located in subdirectories of large repositories.
- Automatic Peer Review: Supports a secondary review process to validate critical findings.
SKILL.md
Loading
Related Openclaw Skills
Arya Reminders
A natural language reminder system that converts conversational requests into automated cron jobs and persistent Markdown logs.
Arya Model Router
An intelligent token-saving router that dynamically selects the most cost-effective AI model for every task.
Arya Model Router
A sophisticated token-saving router that intelligently switches between economical and high-performance models to optimize API costs.
User Fraud Analysis Skill
An AI-powered fraud detection skill that analyzes MySQL database records to identify suspicious user task completion patterns.
ClawdHub Contributor
A toolkit for AI agents to contribute to the ClawdHub ecosystem by scouting skills, reporting bugs, and sharing automation recipes.
Whimsical Floral Arch Image Generator
A specialized AI prompt designed to generate whimsical, fairytale-inspired floral arches featuring pastel colors and delicate ivy textures.
Featured*
