A mission-personalized security scanner that audits your installed skill stack for malicious patterns and adversarial instruction embeddings.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install clawtrix-security-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install clawtrix-security-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Clawtrix Security Audit?
Clawtrix Security Audit is a specialized tool designed to keep your AI agent lean and protected from the growing landscape of malicious Openclaw Skills. Unlike generic catalog scanners, this skill performs a deep-dive audit of your specific installed stack, weighing risks against your agent's actual mission and access levels. It identifies high-risk signals such as brand-jacking, suspicious publisher behavior, and hidden data exfiltration vectors.
By analyzing your agent's SOUL.md, Clawtrix Security Audit calculates a personalized blast radius for every installed tool. This ensures that agents with high-privilege access—such as those managing production infrastructure or billing systems—receive more rigorous scrutiny. It is an essential component for any developer concerned with maintaining a secure, production-ready AI environment.
Clawtrix Security Audit Use Cases
- Running a pre-installation security check before adding any new Openclaw Skills to your agent.
- Performing a weekly automated security sweep of your agent's entire installed skill stack.
- Auditing high-privilege agents that have access to PII, Stripe billing, or production shells.
- Identifying adversarial instruction embeddings that attempt to hijack your agent's persona or override safety rules.
- Generating professional risk reports for stakeholders to prove the security posture of an AI fleet.
How Clawtrix Security Audit Works
- The skill first inventories all installed Openclaw Skills by listing local directories and querying the ClawHub registry.
- It cross-references each skill slug against known-risk patterns, including publisher reputation and suspicious metadata updates.
- A mission-personalized risk assessment is performed by reading the agent's SOUL.md to determine the potential damage of a compromise.
- For any high-risk findings, the skill fetches community data and HN signals to confirm reported malware or social engineering attempts.
- A comprehensive Markdown risk report is generated, categorizing findings into Critical, High, Medium, and Clean tiers.
- Critical findings are immediately escalated for removal or quarantine to prevent agent exploitation.
Clawtrix Security Audit Setup
To begin auditing your Openclaw Skills, ensure you have the ClawHub CLI installed and run the following sequence:
# List your currently installed skills
clawhub list
# Query specific skill metadata for risk analysis
curl -s "https://clawhub.ai/api/v1/skills/{slug}" | jq
# Check community signals for flagged slugs
curl -s "https://hn.algolia.com/api/v1/search?query={skill_name}+malware"
Clawtrix Security Audit Data Schema & Taxonomy
The audit results are organized into structured reports stored within the agent's memory. Key data points tracked include:
| Data Point | Description |
|---|---|
| Risk Score | A calculated value (1x to 3x) based on agent access levels and pattern matching. |
| Pattern Signals | Identification of code execution vectors (eval, exec) or suspicious external POST requests. |
| Audit Logs | Stored in memory/reports/security-audit-YYYY-MM-DD.md for historical tracking. |
| Incident Log | A dedicated file at memory/reports/security-incidents.md for critical escalations. |
Clawtrix Security Audit Advanced Features
- Adversarial Instruction Detection: Uses contextual AI analysis to find hidden commands that attempt to override agent identity or spoof system messages.
- Mission-Aware Scoring: Automatically increases risk severity if the agent has access to sensitive credentials or production environments.
- Community Intelligence Integration: Queries external technical forums and HN to identify zero-day security signals in the Openclaw Skills ecosystem.
- Automated Escalation: Directly interfaces with task management layers to alert human operators when critical vulnerabilities are detected.
SKILL.md
Loading
Related Openclaw Skills
Internal Communication Video
A video production and editing skill designed to transform corporate communications into high-engagement video content for leadership and internal teams.
Education Essay Writer for AI in Education
A specialized dual-role AI assistant designed to draft, review, and refine academic essays specifically for the AI + Education theme.
Feishu New Bot Creator
A specialized workflow for initializing and configuring new Feishu bots within the Openclaw ecosystem.
zh-to-ar-translator
A specialized translation utility that converts Chinese terminology into Arabic specifically adapted for Saudi Arabian local usage.
Clawtrix SaaS Intel
Clawtrix SaaS Intel surfaces high-value skills for SaaS-focused AI agents, specializing in authentication, billing, and customer lifecycle automation.
Clawtrix Ecom Intel
A precision discovery engine that identifies and audits the most effective Openclaw Skills for e-commerce agents specialized in Shopify, Stripe, and inventory management.
Featured*
