A comprehensive security framework and automated checklist designed to audit third-party code and integrations before deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install security-heuristics
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install security-heuristics using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Evaluation Heuristics?
Security Evaluation Heuristics is a critical defensive skill designed to protect users from malicious code, supply chain attacks, and credential theft. It serves as a rigorous mental and technical framework for vetting Openclaw Skills before they are granted access to a system. By enforcing a trust-nothing approach, it ensures that every script, configuration, and external dependency is thoroughly inspected for dangerous patterns and verified for author reputation.
This skill is particularly vital for users of AI agents who may inadvertently install scripts with a wide blast radius. It provides the necessary tools to identify obfuscated code, hidden network calls, and excessive permission requests, transforming security from an afterthought into a mandatory pre-installation step for any environment using Openclaw Skills.
Security Evaluation Heuristics Use Cases
- Auditing third-party Openclaw Skills before local installation to ensure environment safety.
- Scanning downloaded scripts for hidden backdoors, credential stealers, or malicious command substitutions.
- Verifying the reputation and provenance of developers before executing their code.
- Establishing a standardized security vetting protocol for teams using AI coding agents.
How Security Evaluation Heuristics Works
- Perform a deep manual inspection of all files within a package, including scripts and hidden configurations.
- Run automated grep patterns to identify high-risk strings such as network requests, evaluation commands, and credential access.
- Conduct a provenance check to verify the identity and reputation of the author on platforms like Moltbook or GitHub.
- Analyze the blast radius by determining exactly what the code accesses, such as the filesystem, network, or sensitive environment variables.
- Apply a default-to-no decision logic, rejecting any skill that is obfuscated, unverified, or requests unnecessary permissions.
Security Evaluation Heuristics Setup
To implement the automated portion of this security protocol, ensure your environment has grep utilities available. Use the following commands to scan any new Openclaw Skills:
# Navigate to the directory of the skill you want to audit
cd path/to/skill-folder
# Run the security audit patterns
grep -r "curl\|wget\|http://\|https://" .
grep -r "bash\|sh -c\|eval" .
grep -r '\$(\|`' .
grep -r "env\|credentials\|api.key\|token" .
grep -r "base64\|decode" .
Security Evaluation Heuristics Data Schema & Taxonomy
The skill follows a heuristic evaluation structure to organize security findings and metadata:
| Evaluation Category | Audit Focus | Risk Indicators |
|---|---|---|
| Code Integrity | File transparency | Minification, obfuscation, base64 encoding |
| Execution Patterns | Command substitution | Usage of eval, bash -c, or backticks |
| Network & Data | Exfiltration vectors | Presence of curl, wget, or hardcoded URLs |
| Author Identity | Provenance | Reputation on GitHub/Moltbook, historical trust |
| Permission Scope | Access control | Requests for env variables or filesystem write access |
Security Evaluation Heuristics Advanced Features
- Scripted batch auditing for verifying multiple Openclaw Skills simultaneously.
- Hardened skepticism logic designed to defend against social engineering and "cool feature" decoys.
- Integration-ready command patterns for CI/CD pipelines to block insecure skill deployments.
- Comprehensive risk-assessment checklist that acts as the final line of defense for non-technical users.
SKILL.md
Loading
Related Openclaw Skills
Post Queue
A specialized queuing system that automates content posting while respecting platform-specific rate limits and cooldown periods.
Context Checkpoint Skill
A proactive state preservation tool that saves conversation context and open threads to prevent AI memory loss during context compression.
Stakingverse LUKSO Staking
Automate liquid staking on the LUKSO network by depositing LYX to receive yield-bearing sLYX tokens through the Stakingverse protocol.
StakeWise Ethereum Staking
An automated liquid staking integration for StakeWise V3 that handles ETH deposits, osETH minting, and complex keeper-oracle state updates.
Social Memory
A persistent relationship management system that allows AI agents to remember entities, track interaction history, and manage trust levels.
Filtrix Image Gen
A versatile image generation and editing tool for Openclaw Skills that bridges OpenAI, Google Gemini, and fal.ai into a single interface.
Featured*
