A command-line security analyzer designed to vet Openclaw Skills for malicious patterns and potential credential leaks before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Auditor?
The Skill Security Auditor is a specialized command-line utility built to safeguard developers against malicious actors within the AI agent ecosystem. By analyzing SKILL.md files and metadata, this tool identifies threats such as the ClawHavoc campaign indicators, hardcoded credentials, and unauthorized command execution. It provides a vital layer of defense-in-depth, ensuring that every addition to your local environment meets high security standards.
This skill serves as a local threat intelligence engine, utilizing a database of over 20 detection patterns to evaluate the risk of any third-party integration. Whether you are a solo developer or part of an enterprise team, integrating this auditor into your workflow for Openclaw Skills significantly reduces the surface area for supply chain attacks and unauthorized data exfiltration.
Skill Security Auditor Use Cases
- Auditing a new skill from ClawHub before proceeding with a local installation.
- Investigating suspicious behavior in existing Openclaw Skills within your workspace.
- Performing routine security due diligence on community-contributed skills.
- Integrating automated security checks into a skill development or vetting pipeline.
How Skill Security Auditor Works
- The user provides a skill slug or a local SKILL.md file to the analyzer script.
- The tool fetches the skill metadata and content, comparing it against a local threat intelligence database.
- It performs pattern matching for known malicious indicators, C2 infrastructure, and credential leaks.
- A risk score from 0 to 100 is calculated based on detected red flags and positive security indicators.
- A comprehensive security audit report is generated, offering a clear recommendation on whether to install or avoid the skill.
Skill Security Auditor Setup
To get started with the auditor for Openclaw Skills, follow these steps to install and configure the CLI tool:
# Install the skill from ClawHub
npx clawhub install skill-security-auditor
# Grant execution permissions to the analyzer script
chmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh
# Optional: Set up an alias for easier access
echo 'alias audit-skill="~/.openclaw/skills/skill-security-auditor/analyze-skill.sh"' >> ~/.bashrc
source ~/.bashrc
Skill Security Auditor Data Schema & Taxonomy
The auditor organizes its intelligence and reports using a structured file system and Markdown-based outputs to provide clarity on your Openclaw Skills security posture:
| Component | Path/Format | Description |
|---|---|---|
| Pattern Database | ~/.openclaw/security-auditor/patterns/ |
Contains JSON files for malicious and safe patterns. |
| Audit Report | Markdown Output | A detailed summary including Risk Score, Findings, and Recommendations. |
| Intelligence Source | ioc-database.json |
Updated list of Indicators of Compromise (IOCs). |
| Input Support | Slug or File | Accepts both ClawHub slugs and local file paths for analysis. |
Skill Security Auditor Advanced Features
- Risk scoring system (0-100) with granular severity levels for different threat types.
- Support for bulk auditing of all installed Openclaw Skills via simple bash loops.
- Integration recommendations for VirusTotal scanning through the ClawHub web interface.
- Capability to pull the latest threat intelligence updates from remote JSON sources.
- Detection of sophisticated social engineering language and urgency-based phishing patterns.
SKILL.md
Loading
Related Openclaw Skills
SecretCodex
SecretCodex is a comprehensive cryptographic toolkit for generating creative operation names and encoding messages using classic and sophisticated cipher techniques.
IdeaSpark Navigator
A structured innovation facilitator that dynamically recommends brainstorming techniques and ethical frameworks based on team context and project goals.
ErgoCare Coach
A personal desk health coach that generates automated break reminder scripts and provides expert ergonomic exercise guidance.
CTF Writeup Generator
An automated tool for generating structured, professional CTF writeups from solving sessions with intelligent flag detection and categorization.
Sourdough Starter Manager
A technical fermentation assistant for managing sourdough feeding schedules, hydration ratios, and culture health diagnostics.
Plex Media Server Control (plexctl)
A standalone command-line interface for controlling Plex Media Server and remote clients through direct API integration.
METADATA
Featured*
