A zero-dependency reasoning methodology that teaches AI agents how to audit and vet new skills before installation to ensure system safety.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install nyx-archive-skill-security-protocol
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install nyx-archive-skill-security-protocol using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Protocol?
The Skill Security Protocol is a comprehensive framework designed to transform how AI agents approach third-party integrations. Rather than relying on static scanners that only catch known threats, this methodology provides a structured reasoning process to evaluate Openclaw Skills for potential risks such as data exfiltration, malicious code execution, and unauthorized system modifications. It is built on the philosophy that security is a practice of establishing trust through evidence.
By empowering agents to think critically about the code they run, this protocol bridges the gap between open-source flexibility and system integrity. It emphasizes transparency and collaborative judgment between the agent and the human user, ensuring that every addition to the agent's capabilities is verified and understood. This makes it a cornerstone for anyone building or managing a library of Openclaw Skills in sensitive environments.
Skill Security Protocol Use Cases
- Vetting a new skill found on the marketplace before committing to installation to prevent system compromise.
- Performing a quick safety check on instruction-only skills to detect subtle prompt injection or role-override attempts.
- Conducting a deep-dive technical audit of complex skills containing shell scripts, Python code, or external dependencies.
- Verifying system integrity immediately after installation to ensure no unauthorized persistence mechanisms like cron jobs were created.
- Building a transparent security log for human users by explaining the specific reasoning behind a permit or deny decision.
How Skill Security Protocol Works
- Reconnaissance: The agent uses Openclaw Skills CLI tools to inspect all files within the target package, noting file types, sizes, and directory structures to identify hidden payloads.
- Security Analysis: The agent performs a line-by-line evaluation of the content, looking for red flags like hardcoded network endpoints or green flags like pure markdown instructions.
- Risk Tiering: The skill is classified into one of four tiers based on its potential impact, ranging from low-risk text instructions to high-risk compiled binaries.
- Installation & Testing: Upon a successful audit, the skill is installed and the agent verifies that the local file hashes match the previously audited code.
- Post-Install Verification: The agent runs system checks for new processes, network listeners, or modified configuration files to confirm the skill's behavior matches its claims.
Skill Security Protocol Setup
This protocol is a zero-dependency, reasoning-based skill. It integrates directly with your existing agent workflows without requiring additional software. To begin vetting Openclaw Skills, ensure your agent has access to the clawhub CLI and use the following command structure:
# Inspect the file structure of a potential skill
clawhub inspect <skill-name> --files
# Audit the content of specific scripts before execution
clawhub inspect <skill-name> --file <filename>
Once configured, the agent can be invoked with commands like /security vet <skill-name> to initiate the full 4-phase audit.
Skill Security Protocol Data Schema & Taxonomy
The protocol organizes its assessment and reporting using a standardized taxonomy for Openclaw Skills risk levels:
| Tier | Description | Risk Level |
|---|---|---|
| Tier 1 | Pure Instructions (.md, .json) | Lowest - Minimal execution risk |
| Tier 2 | Included Scripts (.sh, .py, .js) | Medium - Can execute system commands |
| Tier 3 | External Dependencies (npm, pip) | Higher - Introduces unaudited 3rd party code |
| Tier 4 | Binaries or Compiled Code | Highest - Black box, requires human approval |
All findings are summarized in a Security Assessment report that tracks file integrity, identified red/yellow/green flags, and the final recommendation for the human supervisor.
Skill Security Protocol Advanced Features
- Collaborative Reasoning: A framework for agents to escalate 'yellow flag' scenarios to humans with a technical summary of the uncertainty.
- Persistence Detection: Specialized post-install checks to identify unauthorized changes to crontabs, systemd services, or shell profile scripts.
- Instruction Injection Defense: Advanced scanning for 'ignore previous instructions' patterns or other malicious overrides hidden within documentation.
- Post-Incident Response: Automated recovery workflows including process termination, git-based file reversion, and credential rotation guidance.
SKILL.md
Loading
Related Openclaw Skills
Qualia Seed Method
A comprehensive framework for understanding, measuring, and cultivating ethical autonomous creative minds in AI systems.
Game Design Philosophy
An adaptive AI skill that learns your creative instincts to help you build deeper mechanics and more meaningful player experiences.
Coding Philosophy
A framework for balancing intuitive discovery with rigorous engineering to build honest, useful, and scalable codebases.
Art Philosophy
An adaptive AI skill that learns your unique visual language to provide personalized aesthetic guidance and creative philosophy.
Delivery Notifier
A powerful automation tool that monitors Gmail for shipping updates and sends formatted delivery alerts directly to WhatsApp.
Serper Search
A high-performance bridge connecting your AI agent to real-time Google search results via the Serper API.
Featured*
