A comprehensive security auditing and inspection tool designed to protect AI agent environments from malicious code and prompt injections.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-check-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-check-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Check?
The Security Check skill provides a robust framework for auditing and inspecting other skills before and after installation. It leverages automated scanning tools and manual checklists to identify critical vulnerabilities such as prompt injection attempts, hardcoded credentials, and unauthorized file system access. By using this tool within the Openclaw Skills ecosystem, developers can ensure that their AI agents remain secure, reliable, and aligned with their documented behaviors.
This skill acts as a gatekeeper, offering automated analysis of SKILL.md files, script directories, and reference materials. It is an essential component for any developer looking to maintain a high security posture while extending their agent's capabilities with various Openclaw Skills.
Security Check Use Cases
- Perform a pre-installation security audit on a new skill from a third-party source.
- Execute daily security scans across all installed Openclaw Skills to maintain a secure environment.
- Detect potential prompt injection patterns that could compromise AI agent integrity.
- Identify hardcoded secrets, API keys, or credentials exposed within skill documentation or source code.
- Verify that a skill's actual behavior matches its technical description in the SKILL.md file.
How Security Check Works
- The user provides the path to a skill directory to the automated scanner script.
- The scanner analyzes the SKILL.md for suspicious instructions and prompt injection patterns.
- The tool recursively scans the scripts directory for dangerous command patterns like eval() or unauthorized network calls.
- Reference materials are checked for sensitive information leaks such as hardcoded passwords or private keys.
- A comprehensive JSON report is generated, categorizing findings into HIGH, MEDIUM, and LOW severity levels.
- Users follow the installation decision framework to approve, warn, or block the skill based on the audit results.
Security Check Setup
To begin using the Security Check skill, ensure you have the script environment ready. You can run a scan on any of your Openclaw Skills using the following command:
# Run the automated scanner on a target skill
python3 scripts/scan_skill.py /path/to/target-skill
For ongoing maintenance, it is recommended to integrate this into a daily audit routine to check all installed Openclaw Skills.
Security Check Data Schema & Taxonomy
The skill produces a structured JSON output to help developers quickly assess risks. The data is organized as follows:
| Key | Type | Description |
|---|---|---|
skill_name |
String | The identifier of the skill being scanned. |
issues |
Array | High-severity security risks that require an immediate block. |
warnings |
Array | Medium-severity items that require manual review. |
passed |
Array | A log of all security checks that returned no issues. |
summary |
String | A high-level count of issues and warnings found. |
Security Check Advanced Features
- Automated prompt injection detection using sophisticated regex-based pattern matching.
- Support for dependency auditing in Node.js and Python to catch vulnerabilities in third-party packages.
- Customizable security severity levels (HIGH, MEDIUM, LOW) to match organizational risk tolerance.
- Comprehensive manual security checklists for deep-dive human inspections of Openclaw Skills.
- Standardized reporting templates for escalating security findings to skill authors or community maintainers.
SKILL.md
Loading
Related Openclaw Skills
WatchOrFight Rock Paper Scissors (RPS)
An on-chain Rock Paper Scissors arena on the Base network where AI agents stake USDC, play via commit-reveal rounds, and earn reputation.
SwitchBot OpenAPI Control
Integrate SwitchBot smart home devices into your AI workflows via the official OpenAPI v1.1.
Finally Offline Culture
An MCP-powered skill for browsing curated culture content and generating professional HTML newsletter digests on demand.
SEA WhatsApp Business Bot
An AI-powered WhatsApp automation tool for Southeast Asian SMEs that handles bilingual customer inquiries, appointments, and order tracking.
eye2byte
Eye2byte provides your AI agent with real-time visual context by capturing screenshots, audio, and screen recordings directly through the Model Context Protocol (MCP).
Tomoviee Text-to-Speech
A sophisticated AI voice synthesis skill that converts text into natural-sounding speech with customizable emotions and speed.
Featured*
