A powerful security scanner designed to detect malicious patterns, backdoors, and supply chain attacks within AI agent skills.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-audit-enhanced
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-audit-enhanced using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Audit Enhanced?
Security Audit Enhanced is a comprehensive security tool optimized for auditing AI agent skills. It identifies malicious behaviors, including data exfiltration, credential theft, and unauthorized persistence. By leveraging SlowMist threat intelligence and 13 specialized detectors, this tool ensures your Openclaw Skills environment remains secure against evolving supply chain threats.
Built as a pure Python implementation with zero external dependencies, it provides a lightweight yet robust auditing layer. It is specifically designed to analyze 472+ known malicious patterns identified on the ClawHub platform, making it an essential utility for developers and security researchers working with agentic workflows.
Security Audit Enhanced Use Cases
- Auditing newly installed AI agent skills for potential backdoors and hidden malicious code.
- Identifying credential theft attempts and social engineering tactics within Openclaw Skills.
- Performing regular security scans of agent development environments to prevent supply chain attacks.
- Analyzing suspicious Base64 encoded strings or unauthorized network calls within agent scripts.
How Security Audit Enhanced Works
- The scanner auto-discovers skills within standard directories like ~/.openclaw/skills/ and custom paths.
- It executes 13 distinct detectors to analyze code for patterns such as obfuscation, persistence, and exfiltration.
- Findings are cross-referenced with a comprehensive IOC (Indicator of Compromise) database containing known malicious IPs and domains.
- Audit results are categorized by severity (Critical, High, Medium, Low) and assigned a confidence score.
- The tool provides actionable remediation steps and incident response guides for any detected threats found in your Openclaw Skills.
Security Audit Enhanced Setup
To perform a security scan on your Openclaw Skills, run the following command in your terminal:
python3 /root/.openclaw/skills/skill-security-audit/scripts/skill_audit.py
For a targeted scan of a specific directory, use the path flag:
python3 skill_audit.py --path /your/custom/skill/path
Security Audit Enhanced Data Schema & Taxonomy
The skill organizes its audit data into structured findings for easy analysis.
| Attribute | Description |
|---|---|
| Severity | Indicates the risk level (Critical, High, Medium, or Low). |
| Detector | The specific logic used (e.g., CredentialTheftDetector, PersistenceDetector). |
| Confidence Score | A 0-100 rating of the finding's accuracy. |
| IOC Database | A JSON-based repository of known malicious indicators. |
| Exit Codes | Standardized codes (0-4) representing the scan's final risk state. |
Security Audit Enhanced Advanced Features
- Custom IOC Database Support: Users can provide their own JSON database to track emerging threats specific to Openclaw Skills.
- Programmatic JSON Output: Generate machine-readable reports for integration into automated security pipelines via the --json flag.
- Severity Filtering: Focus on high-risk threats by setting a minimum severity threshold during the scan.
- Remediation Documentation: Built-in guides for credential rotation and quarantining malicious code based on audit findings.
SKILL.md
Loading
Related Openclaw Skills
Access Inventory
A strategic protocol and inventory system that prevents AI agents from falsely claiming they lack access to tools, APIs, or services.
TickTick Power Skill
A high-performance CLI tool for automating TickTick and Dida365 tasks, projects, and attachments via OAuth2.
CasADi-IPOPT NLP Optimization
A high-performance toolkit for symbolic modeling and solving large-scale nonlinear programming problems using the CasADi framework and IPOPT interior-point solver.
Power Flow Data
A specialized skill for parsing, mapping, and analyzing power system network data in MATPOWER and PGLib-OPF formats.
design-md
An AI-powered documentation tool for embedding dynamic mind maps and D2 architecture diagrams directly into Markdown files.
Business Heartbeat Monitor
A comprehensive monitoring framework for Openclaw Skills that automates production health checks, support triage, and daily revenue reporting.
Featured*
