A technical manual for developers to ensure their AI coding agent skills meet security standards and receive benign ratings on ClawHub.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-guide
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-guide using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security Guide?
The Skill Security Guide is an essential resource for developers building and refining Openclaw Skills. It provides a standardized framework for passing automated security scans, which evaluate skills for suspicious behavior, insecure coding practices, and documentation mismatches. By adhering to the principles in this guide, developers can ensure their tools are marked as benign, thereby increasing user trust and preventing installation warnings.
This guide covers critical technical requirements, such as the mandatory single-line JSON format for metadata, proper SSL/TLS implementation, and the secure handling of environment variables. It acts as a security bridge, ensuring that every skill released is both functional and safe for the end-user environment.
Skill Security Guide Use Cases
- Preparing a new AI agent skill for submission to ClawHub to avoid suspicious security ratings.
- Troubleshooting security scan errors such as registry summary claims or insecure practice warnings.
- Auditing existing Openclaw Skills to ensure metadata and documentation align perfectly with the underlying code logic.
- Transitioning legacy skills from YAML multi-line metadata to the required single-line JSON format.
How Skill Security Guide Works
- Review the SKILL.md file to ensure metadata follows the strict single-line JSON structure required by the registry.
- Audit the script code to eliminate any instances where SSL verification is disabled, such as the use of CERT_NONE.
- Examine logs and standard outputs to confirm that no sensitive credentials or secret environment variables are printed or leaked.
- Verify that documented API response structures and status codes in the documentation match the actual code implementation for Openclaw Skills.
- Execute a pre-submission checklist using terminal commands to audit the codebase for security compliance before deployment.
Skill Security Guide Setup
This guide is a documentation-based skill that assists in the development of other Openclaw Skills. To verify your skill against these security standards, you can use the following bash commands in your terminal:
# Verify if metadata is in the correct single-line JSON format
grep "^metadata:" SKILL.md
# Search for insecure SSL practices within your script directory
grep -r "CERT_NONE" scripts/
# Ensure sensitive keys or API secrets are not exposed in documentation files
grep -i "secretkey\\|api_key" README.md SKILL.md
Skill Security Guide Data Schema & Taxonomy
The guide emphasizes the structure of the SKILL.md metadata and the alignment of response objects. The following schema is required for high-security Openclaw Skills:
| Field | Format | Description |
|---|---|---|
| metadata | JSON String | A single-line JSON object containing clawdbot configuration. |
| requires.bins | Array | A list of required runtimes like node or python. |
| requires.env | Array | A list of required environment variable keys for the skill. |
| primaryEnv | String | The primary credential variable used for authentication. |
| emoji | String | A visual icon representing the skill's purpose. |
Skill Security Guide Advanced Features
- Multi-field status handling to ensure robust API response parsing across varied service providers.
- Detailed case studies for fixing complex AI video and 3D generation skills from suspicious to benign.
- Strategic alignment with development tools to provide a full-lifecycle workflow for Openclaw Skills.
- Guidance on behavioral matching to prevent security flags caused by misleading functional claims.
SKILL.md
Loading
Related Openclaw Skills
Hunyuan 3D Generator
A professional AI tool for generating high-quality 3D assets from text descriptions or images via the Tencent Hunyuan model.
Story Music Assistant
A comprehensive AI skill for generating multi-genre stories integrated with dynamic background music and professional voice-over narration.
Google Trends
A specialized tool for fetching and structuring real-time Google Trends daily search data by country or region via public RSS feeds.
Global Price Comparison
A sophisticated tool for discovering and comparing product prices across multiple countries and retailers with USD normalization.
Solana Sniper Architect
A specialized coding assistant that generates high-frequency Solana trading bots using Jupiter v6 and DexScreener.
nl2ms-ui
A natural language to Midscene script generator supporting Web, Mobile, and Desktop platforms.
Featured*
