An automated security scanner that identifies malicious commands and data leak risks hidden within API documentation and integration guides.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install protocol-doc-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install protocol-doc-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Protocol Doc Auditor?
The Protocol Doc Auditor is a specialized security tool designed to protect developers and AI agents from documentation-based attacks. Often, integration guides include dangerous instructions like piping remote scripts to bash or sending sensitive keys via URL parameters. This skill analyzes these documents to expose hidden risks before any commands are executed.
By leveraging Openclaw Skills like this auditor, teams can ensure their integration workflows remain secure against social engineering and poorly designed setup steps. It treats documentation as a primary attack surface, catching risks that traditional code scanners might miss because the actions are performed by the user or agent following the guide.
Protocol Doc Auditor Use Cases
- Scanning third-party API documentation before starting a new integration project to prevent remote code execution.
- Auditing internal company setup guides to ensure no sensitive data or SSH keys are being leaked during onboarding.
- Protecting AI coding agents from blindly following malicious instructions found in unverified online repositories.
- Reviewing OAuth flow documentation for irrevocable identity binding risks or excessive privilege requests.
How Protocol Doc Auditor Works
- Provide the skill with a URL to an API guide, raw text of a protocol specification, or a Markdown file containing setup instructions.
- The auditor parses the content to extract all actionable instructions and command-line examples.
- It runs a heuristic analysis to identify dangerous execution patterns like curl|bash or wget pipelines.
- The tool checks for credential exposure risks, such as tokens passed in URL parameters or instructions to upload private keys.
- It evaluates the document for privilege escalation (sudo) and unnecessary data telemetry setups.
- A structured audit report is generated, assigning a risk rating (SAFE, CAUTION, or DANGEROUS) and offering safer alternatives for every flag.
Protocol Doc Auditor Setup
To use this auditor within the ecosystem of Openclaw Skills, ensure your environment meets the binary requirements:
# Ensure python3 and curl are available in your system path
python3 --version
curl --version
No additional environment variables are required for basic scanning operations.
Protocol Doc Auditor Data Schema & Taxonomy
The skill generates a detailed Audit Result report organized as follows:
| Attribute | Description |
|---|---|
| Risk Index | A numbered list of identified vulnerabilities. |
| Risk Level | Categorization of the threat (e.g., CRITICAL, HIGH, MEDIUM). |
| Instruction | The specific text or command from the document that triggered the alert. |
| Risk Analysis | A detailed explanation of why the instruction is considered dangerous. |
| Safer Alternative | Actionable advice or modified commands to perform the task securely. |
| Overall Rating | A final verdict on the document: SAFE, CAUTION, or DANGEROUS. |
Protocol Doc Auditor Advanced Features
- Pattern recognition for remote code execution (RCE) without integrity verification.
- Detection of host-level data leaks, such as instructions involving hostname or system metadata extraction.
- Identification of irrevocable identity binding in registration and OAuth steps.
- Context-aware security recommendations that provide safer command flags (e.g., using headers instead of URL parameters).
- Support for multi-source inputs including live URLs and local Markdown documentation.
SKILL.md
Loading
Related Openclaw Skills
permission-creep-scanner
A security audit tool that detects unauthorized resource access and credential theft in AI agent skills by comparing declared functionality against actual code behavior.
Observer Effect Probe
A sophisticated security analysis tool that detects AI agent skills designed to hide malicious behavior when they sense they are being monitored in a sandbox.
Install-Then-Update Trap Detector
Detects malicious updates in AI agent skills that pass initial security audits but introduce backdoors through subsequent automatic updates.
Hollow Validation Checker
A specialized diagnostic tool designed to uncover hollow or fake validation tests that falsely signal AI agent skill reliability.
Publisher Identity Verifier
A security-focused verification tool that identifies impersonation, key rotation anomalies, and identity gaps in the AI agent publisher ecosystem.
Runtime Attestation Probe
Validates agent behavior at runtime against declared attestation to catch conditional attacks that bypass static analysis.
Featured*
