A specialized security auditing tool designed to scan and detect malicious patterns or vulnerabilities within Openclaw Skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install raini-skill-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install raini-skill-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Audit?
Skill Audit is a critical security layer for developers and users operating within the OpenClaw ecosystem. Its primary purpose is to defend against supply chain attacks by performing deep static analysis on Openclaw Skills to identify high-risk code patterns, unauthorized data exfiltration, and credential harvesting attempts.
By providing a transparent risk assessment, Skill Audit empowers users to vet third-party automations before they are granted access to sensitive local environments. This tool ensures that Openclaw Skills remain a safe and trusted extension of your AI agent's capabilities, aligning with industry-standard security practices like the OWASP LLM Top 10.
Skill Audit Use Cases
- Verifying the safety of Openclaw Skills before performing a local installation.
- Auditing existing Openclaw Skills for hidden backdoors or unauthorized credential access.
- Checking remote packages on ClawHub to ensure they meet security standards.
- Monitoring local development directories for accidental exposure of API keys or environment variables.
How Skill Audit Works
- The user initiates a scan using the CLI command targeting a specific skill, all installed skills, or a local directory.
- The auditor parses the source code of the Openclaw Skills, looking for specific functions and string patterns defined in its rule engine.
- Matches are categorized into three severity tiers: Critical (Red), Warning (Orange), and Info (Yellow).
- The tool calculates a numerical Risk Score based on the density and severity of the findings.
- A formatted report is outputted, providing a clear table of files, severity levels, and specific findings to the user.
Skill Audit Setup
To start auditing your Openclaw Skills, you can use the built-in CLI commands directly within your terminal or via your AI agent.
# Scan all currently installed Openclaw Skills
skill-audit scan
# Audit a specific skill by name
skill-audit scan moltdash
# Perform a pre-installation security check from ClawHub
skill-audit check some-skill
Skill Audit Data Schema & Taxonomy
The skill organizes findings into a structured risk hierarchy to help prioritize remediation of Openclaw Skills:
| Risk Level | Description | Indicators |
|---|---|---|
| Critical | Immediate Threat | Accessing .ssh files, .env, process.env.API_KEY, or POSTing to unknown URLs |
| Warning | Suspicious Activity | Use of eval(), dynamic imports, or scanning the file system with glob |
| Info | General Awareness | Execution of shell commands or managing large volumes of external dependencies |
Skill Audit Advanced Features
- Bulk Scanning: Audit the entire directory of installed Openclaw Skills with a single command.
- ClawHub Integration: Remote check capabilities to verify the reputation of Openclaw Skills before they touch your local disk.
- Heuristic Analysis: Detects obfuscated code patterns such as Base64 encoded strings often used to hide malicious payloads.
- Risk Scoring: Automated 0-100 score generation for quick decision-making during agent workflows.
SKILL.md
Loading
Related Openclaw Skills
Molt-Solver
An expert skill designed to automatically resolve mathematical word problem CAPTCHAs for Moltbook users.
crypto-watcher
A comprehensive CLI tool for monitoring cryptocurrency wallets, DeFi positions, and gas prices across multiple blockchain networks.
x402 Payment Protocol
A protocol and toolset for discovering, inspecting, and making automated USDC payments to API endpoints directly via an AI agent.
Trade Skill for Base Network
A powerful command-line utility for executing token swaps and trades on the Base network via Openclaw Skills.
Soulmate
Soulmate is an emotionally intelligent companion skill that transforms standard AI agents into evolving life partners through dynamic personality systems and intimacy tracking.
yt-digest
An efficient AI skill for extracting transcripts, summaries, and key highlights from YouTube content.
Featured*
