A comprehensive security auditing tool designed to identify malicious patterns, prompt injections, and supply chain risks in agent skills before they are installed.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-audit-2
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-audit-2 using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ClawHub Skill Security Audit?
The ClawHub Skill Security Audit is a specialized safety tool designed for the ecosystem of Openclaw Skills. It provides a robust framework for evaluating the security posture of third-party skills by performing automated static analysis and facilitating structured expert reviews. This skill is specifically engineered to detect sophisticated threats like prompt injection, malicious script patterns, and data exfiltration risks, ensuring your AI agent environment remains untainted by supply chain attacks.
By combining automated scanning with a deep-dive analysis of SKILL.md files and script behaviors, it offers a multi-layered defense mechanism. Whether you are a developer vetting a community contribution or an enterprise admin managing internal agent capabilities, this tool provides the necessary intelligence to make informed installation decisions regarding Openclaw Skills.
ClawHub Skill Security Audit Use Cases
- Evaluating the safety of a new skill from ClawHub before local installation.
- Detecting hidden prompt injection directives that attempt to override agent safety guidelines.
- Identifying obfuscated code, unauthorized network calls, or sensitive file system access in skill scripts.
- Verifying the integrity of downloaded packages using SHA-256 file hashing.
- Assessing the risk level of Openclaw Skills involved in complex automation workflows.
How ClawHub Skill Security Audit Works
- The user provides a target via a local directory path, a ClawHub slug, or a full URL.
- The automated scanner fetches the skill metadata and download package from the ClawHub API if it is not already present locally.
- A static analysis engine scans the skill's content against over 60 known malicious indicators, including behavioral and structural patterns.
- The system prompts an expert review of the SKILL.md file to detect semantic traps, hidden Unicode characters, or social engineering attempts.
- All scripts and dependencies are analyzed for network behavior, persistence mechanisms, and access to sensitive locations like SSH keys or environment variables.
- A final Security Assessment Report is generated, assigning a risk rating from SAFE to CRITICAL with specific installation recommendations.
ClawHub Skill Security Audit Setup
This skill requires Python 3 and uses the standard library for its core operations. No external Node.js dependencies are required for the scanner component. Use the following commands to begin auditing Openclaw Skills:
# To scan a skill already located on your disk
python3 scripts/scan_skill.py <target-skill-directory>
# To scan a skill directly from ClawHub using its slug
python3 scripts/scan_skill.py --slug <skill-slug>
# To scan a specific version of a skill
python3 scripts/scan_skill.py --slug <skill-slug> --version <version-number>
ClawHub Skill Security Audit Data Schema & Taxonomy
The skill produces a structured JSON security report and maintains a threat knowledge base for reference. Data is organized as follows:
| Component | Description |
|---|---|
| scan_metadata | Contains the audit timestamp, tool version, and the target path evaluated. |
| summary | A high-level count of findings categorized by severity (CRITICAL, HIGH, MEDIUM, LOW). |
| findings | Detailed entries including the specific file, line number, matched malicious text, and remediation advice. |
| file_inventory | A complete list of all files within the Openclaw Skills package with their corresponding SHA-256 hashes for integrity verification. |
| threat_knowledge_base | A reference markdown file detailing known attack vectors like the ClawHavoc campaign. |
ClawHub Skill Security Audit Advanced Features
- Direct ClawHub API integration for seamless downloading and scanning of remote skills.
- Automatic temporary directory management that cleans up extracted skill files after the audit is complete.
- Comprehensive pattern matching for 60+ threat indicators, including RCE chains and reverse shells.
- Version-specific scanning to track security changes across different releases of Openclaw Skills.
- Support for detecting advanced obfuscation techniques like zero-width characters and Base64-encoded payloads.
SKILL.md
Loading
Related Openclaw Skills
Caiyun Weather
A weather data integration for Openclaw Skills providing real-time conditions, forecasts, and historical records via the Caiyun Weather API.
Simple Text Formatter
A specialized tool for Openclaw Skills that automates text standardization by applying consistent capitalization, spacing, and punctuation rules.
Simple Text Formatter
An AI-powered text normalization tool that automatically applies style guidelines to capitalize sentences and fix punctuation.
Simple Text Formatter
An automated text styling tool that enforces grammatical and spacing guidelines for clean documentation.
ClawHub Skill Stats
A high-performance CLI utility to fetch and compare engagement metrics for any skill on the ClawHub registry.
OpenClaw Integrations API
A comprehensive integration framework that enables AI agents to discover and execute actions across third-party platforms via a unified API.
Featured*
