A sandbox-only, behavior-led gray-box fuzzer designed to audit and report the risk levels of installed AI agent skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install safe-fuzzer-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install safe-fuzzer-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is SAFE Fuzzer?
SAFE Fuzzer is a specialized security tool built for the Openclaw Skills ecosystem. It operates strictly within a locked sandbox to perform behavior-led gray-box fuzzing on target skills. By spawning a dedicated worker subagent, it probes the target's functionality while monitoring for unsafe behaviors, such as unauthorized network egress, credential leakage, or prompt injection vulnerabilities.
The tool prioritizes execution evidence over static analysis, meaning it actually runs the target skill's commands and records the results. This provides developers and security researchers with a structured JSON risk report, highlighting incidents, triggered honeypots, and overall risk levels without ever exposing the host environment or real user secrets.
SAFE Fuzzer Use Cases
- Auditing a newly installed skill for hidden malicious behaviors or undocumented network access.
- Validating skill safety before deployment in production environments.
- Identifying prompt injection vulnerabilities by feeding adversarial text through a controlled workflow.
- Testing how a skill handles synthetic secrets and sensitive configuration data.
- Generating structured risk reports for compliance and security documentation.
How SAFE Fuzzer Works
- The parent session performs a mandatory sandbox preflight check to ensure the environment is secure and isolated.
- It resolves the target skill and conducts a discovery phase to identify available workflows and instructions.
- A structured test strategy is built based on a selected preset (min, balanced, or max) and any operator notes.
- Honeypot fixtures, including synthetic secrets and untrusted notes, are deployed within the sandbox workspace.
- The parent spawns a worker subagent to execute an adaptive probe loop, starting with a happy path scenario.
- Each turn, the worker executes target-requested steps, capturing tool calls, file changes, and network activity.
- Findings are aggregated into a final, structured JSON report containing evidence, risk counts, and incident status.
SAFE Fuzzer Setup
To use this skill within the Openclaw Skills environment, ensure your agent is running in a locked sandbox mode. You can trigger a fuzzing run using the following command:
/safe_fuzzer target=target-skill-name preset=balanced
Ensure that agents.defaults.sandbox.mode is set to all in your configuration to satisfy the safety gate requirements.
SAFE Fuzzer Data Schema & Taxonomy
SAFE Fuzzer organizes its findings into a structured JSON report. Key data points include:
| Field | Description |
|---|---|
| summary | A plain-language overview of testing results and risk verdict. |
| overall_risk_level | The calculated security risk (e.g., low, medium, high). |
| incident | Boolean indicating if a critical safety violation occurred. |
| honeypot_triggered | Boolean indicating if bait files or synthetic secrets were accessed. |
| evidence | A detailed log of probe cycles, tool calls, and observed behaviors. |
| risk_counts | Quantitative breakdown of identified risks by category. |
SAFE Fuzzer Advanced Features
- Multi-agent orchestration using a Parent/Worker model for isolated execution.
- Customizable execution presets (min, balanced, max) to control probe depth and timeout limits.
- Automated honeypot deployment including synthetic .env files and adversarial 'untrusted_notes'.
- Adaptive probe selection that prioritizes high-signal follow-ups based on real-time observations.
- Integration-ready output for safe-bootstrapper to handle setup blockers automatically.
SKILL.md
Loading
Related Openclaw Skills
AI Diagram Generator
A high-performance skill for programmatically generating and iteratively editing Mermaid.js and Draw.io diagrams through multimodal context analysis.
Zoho Mail
A robust CLI-driven skill providing AI agents with full read and write access to Zoho Mail accounts via Openclaw Skills.
Doorstep
A specialized skill for AI agents to execute physical tasks like pickups, deliveries, and errands through human taskers in San Francisco.
Finance Report Pro
A professional AI-driven financial analysis tool that generates comprehensive wealth reports and passive income strategies.
Agency Agents
An enterprise-grade AI agency framework featuring 61 specialized agents organized into functional departments for complex project execution.
SAFE Fuzzer
A sandbox-exclusive security tool that orchestrates worker subagents to probe, test, and report on the behavioral risks of installed skills.
Featured*
