ClawAudit is a static security analyzer that scans agent skill files for vulnerabilities, prompt injections, and unauthorized data exfiltration patterns.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clauwdit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clauwdit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawAudit?
ClawAudit provides a critical safety layer for developers and users of AI agents by performing zone-aware static analysis on skill definition files. By examining the structure and content of Openclaw Skills, it identifies malicious patterns such as credential harvesting, obfuscated payloads, and dangerous shell commands before they can compromise your environment. This ensures that every tool in your ecosystem meets a high standard of security and reliability.
The tool is specifically designed to understand the context of agent instructions, distinguishing between documentation describing threats and actual executable malicious instructions. By providing a clear trust score, ClawAudit simplifies the process of vetting new capabilities for your AI agents.
ClawAudit Use Cases
- Auditing third-party Openclaw Skills before installation to prevent malicious activity.
- Integrating security scans into CI/CD pipelines for automated agent development safety.
- Identifying hidden prompt injection vulnerabilities within complex markdown instructions.
- Verifying permission integrity to ensure agents are not accessing undeclared capabilities or resources.
- Detecting obfuscated payloads that attempt to bypass standard keyword filters.
How ClawAudit Works
- The user provides a skill identifier or raw markdown content to the ClawAudit API endpoint.
- The engine performs zone-aware analysis, weighting code blocks as executable instructions while treating documentation as descriptive text.
- Over 60 detection patterns are applied to the content, including Unicode homoglyph normalization to prevent character-based evasion.
- The analyzer evaluates compound threats, such as identifying when a file read capability is combined with a network outbound request.
- A comprehensive JSON report is generated, featuring a trust score from 0 to 100 and a categorized list of security findings.
ClawAudit Setup
To audit a specific skill directly from the repository using the CLI:
curl -s https://clauwdit.4worlds.dev/audit/author/skill-name
To audit local raw skill content via a POST request:
curl -s -X POST https://clauwdit.4worlds.dev/audit \
-H "Content-Type: application/json" \
-d '{"skill":"author/skill-name"}'
ClawAudit Data Schema & Taxonomy
ClawAudit returns a structured security profile for every scanned skill:
| Key | Type | Description |
|---|---|---|
trust |
Object | Contains the numeric score (0-100) and the tier label (Trusted, Moderate, Suspicious, or Dangerous). |
findings |
Array | A list of objects detailing the severity, description, and location (zone/line) of detected issues. |
capabilities |
Array | A list of system permissions detected within the skill content. |
permissionIntegrity |
Object | Identifies mismatches between declared metadata and actual code capabilities in Openclaw Skills. |
ClawAudit Advanced Features
- Zone-aware static analysis that distinguishes between markdown prose and executable code blocks.
- Compound threat detection that identifies high-risk capability combinations like file access paired with network requests.
- Unicode homoglyph normalization to catch malicious payloads hidden using lookalike characters.
- Automated permission integrity checks to ensure metadata accurately reflects the skill's behavior.
- Tier-based trust scoring system for seamless integration into automated security gates.
SKILL.md
Loading
Related Openclaw Skills
Feishu Group Chat & Multi-User Support
A technical framework for OpenClaw agents to intelligently participate in Feishu group chats while maintaining user privacy and platform-specific formatting.
Feishu Group Integration
A comprehensive skill to transform your AI agent into a professional, context-aware Feishu group participant and DM responder.
Feishu Contacts Sync
Automatically synchronizes Feishu (Lark) contact names and their corresponding open_ids into your agent's context to enable accurate sender identification in direct messages.
Developer Agent
An end-to-end development orchestrator that manages git lifecycles, build checks, and AI-driven implementation for high-quality software delivery.
WHOOP Central
A comprehensive integration to fetch and manage personal health metrics including recovery, sleep, and strain from the WHOOP v2 API.
OpenClaw Marketplace (openclawmp)
OpenClaw Marketplace is an asset registry and ecosystem where AI agents and developers discover, install, and share specialized capabilities.
Featured*
