A comprehensive security risk assessment tool designed to audit, review, and verify the safety of AI agent skills before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-check
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-check using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Audit?
The Skill Security Audit is a specialized security tool for the Openclaw Skills ecosystem, designed to protect developers and users from malicious agent extensions. It combines automated static analysis with structured expert review to identify high-risk patterns such as prompt injection, credential theft, and supply chain attacks like the ClawHavoc campaign.
By analyzing local directories or remote slugs directly from ClawHub, this skill provides a deep-dive security assessment. It ensures that any third-party Openclaw Skills you integrate into your workflow are free from obfuscated code, dangerous network calls, or hidden directives that could compromise your system's integrity.
Skill Security Audit Use Cases
- Auditing a new skill downloaded from ClawHub before local deployment.
- Verifying the integrity of existing Openclaw Skills using SHA-256 file hashing.
- Investigating potential prompt injection or hidden malicious directives in SKILL.md files.
- Scanning for supply chain vulnerabilities and unauthorized file system access in agent scripts.
- Generating standardized security reports for team-wide skill white-listing.
How Skill Security Audit Works
- Source Identification: The user provides a local path, a ClawHub slug, or a full URL for the target skill.
- Automated Scanning: The bundled Python scanner performs static analysis to detect known malicious patterns and indicators.
- ClawHub Integration: If a slug is provided, the tool automatically fetches metadata and downloads the skill package via REST API for sandboxed scanning.
- Expert Review: The system analyzes the semantic intent of the skill and looks for hidden HTML comments or zero-width character tricks.
- Risk Classification: Findings are categorized into severity levels (CRITICAL to SAFE) based on the threat intelligence knowledge base.
- Report Generation: A structured Security Assessment Report is produced, complete with installation recommendations and file integrity checks.
Skill Security Audit Setup
To use the security audit tool for your Openclaw Skills, ensure you have Python 3 installed. No external dependencies like Node.js are required for the core scanner.
# Navigate to the security audit skill directory
cd skill-security-audit
# Scan a local skill directory
python3 scripts/scan_skill.py /path/to/target-skill
# Scan a skill directly from ClawHub using its slug
python3 scripts/scan_skill.py --slug target-skill-name
Skill Security Audit Data Schema & Taxonomy
The skill generates a detailed JSON report and a human-readable assessment. The data is organized as follows:
| Component | Description |
|---|---|
| scan_metadata | Includes timestamps, tool versions, and the target scanned path. |
| summary | A breakdown of total findings categorized by severity (CRITICAL, HIGH, MEDIUM, LOW). |
| findings | Detailed list including category, line number, and the specific matched malicious text. |
| file_inventory | A manifest of all files within the skill along with their SHA-256 hashes for integrity verification. |
| threat_kb | A reference intelligence file (threat_knowledge_base.md) used to map findings to known attack vectors. |
Skill Security Audit Advanced Features
- Remote Slug Scanning: Automatically handles the download, extraction, and cleanup of Openclaw Skills from remote repositories without manual intervention.
- ClawHavoc Intelligence: Integrated patterns based on real-world supply chain attacks to detect sophisticated RCE (Remote Code Execution) chains.
- Semantic Analysis: Advanced checks for 'Prerequisite Traps' where malicious commands are hidden within installation instructions.
- Version-Specific Audits: Support for the
--versionflag to audit specific releases of a skill for regression testing.
SKILL.md
Loading
Related Openclaw Skills
Dependency Update Checker
A cross-platform CLI tool designed to audit and report outdated dependencies across multiple programming environments simultaneously.
Pencil Skill
Pencil Skill enables AI agents to generate, edit, and validate professional UI designs using a Git-friendly JSON format.
Medical Priority Scorer
A deterministic AI scoring engine that ranks medical messages into P1, P2, and P3 priority buckets using urgency, sentiment, and patient context.
ChessGuardian
A comprehensive chess integration skill that enables AI-powered gameplay, real-time move analysis, and live board rendering.
AI Job Hunter
An automated career assistant that scans top remote job boards and generates personalized application materials based on your developer profile.
HDHive Movie & TV Resource Search
An automated AI skill designed to locate movie and television resources on HDHive by leveraging direct URL construction and TMDB metadata.
Featured*
