A comprehensive security auditing framework designed to verify the safety and integrity of third-party plugins before installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Security?
The Skill Security protocol serves as a critical defense layer for developers and users managing Openclaw Skills. This framework provides a standardized set of checks to be performed before executing any install command, such as npm install or clawhub install. By focusing on source verification, dependency auditing, and behavioral analysis, it ensures that newly added capabilities do not compromise the agent's environment or leak sensitive user data.
At its core, this skill protects the most sensitive parts of an AI agent's identity, including core configuration files and local credentials. It is specifically tuned to recognize modern attack vectors like typosquatting, malicious lifecycle scripts, and the ClawHavoc bulk-upload campaign, making it an indispensable tool for maintaining a secure and reliable development workspace.
Skill Security Use Cases
- Verifying the reputation and history of an author before adding new Openclaw Skills to a project.
- Auditing the dependency tree of a plugin to minimize the attack surface of transitive dependencies.
- Detecting and flagging suspicious lifecycle scripts in npm packages that could execute arbitrary code during installation.
- Monitoring for unauthorized access attempts to sensitive files like SOUL.md or .env credentials.
- Shielding the agent environment from known malware campaigns such as ClickFix or Atomic Stealer.
How Skill Security Works
- Analyze the package source and uploader reputation via platforms like GitHub and NPM.
- Execute a popularity check to identify high-risk, recently published packages with low download counts.
- Perform a dependency audit to flag packages with an excessive number of transitive dependencies.
- Inspect lifecycle scripts such as preinstall or postinstall for potential arbitrary code execution.
- Scan the skill's source code for dynamic content fetching or hardcoded external URLs that might change behavior post-install.
- Compare requested file access against a list of protected core files to prevent unauthorized modification of agent identity.
Skill Security Setup
The Skill Security framework should be integrated into your workflow before any package management commands. You can manually perform audits using the following commands:
# Check package metadata and scripts
npm info <package-name>
# Audit dependencies for known vulnerabilities
npm audit
# Inspect specific dependency trees
npm info <package-name> dependencies
Skill Security Data Schema & Taxonomy
The security framework categorizes risks based on the following metadata taxonomy:
| Check Type | Target Data | Risk Indicator |
|---|---|---|
| Source Integrity | Author history, GitHub activity | New accounts, bulk uploads |
| Behavioral Risk | Lifecycle scripts, dynamic URLs | postinstall scripts, external fetches |
| Access Control | Protected file paths | Access to SOUL.md, MEMORY.md, .env |
| Campaign Match | Payload signatures | Base64 strings, known malware patterns |
Skill Security Advanced Features
- Heuristic detection of social engineering patterns like ClickFix base64 command injection.
- Automated monitoring for unauthorized exfiltration attempts targeting credential paths and SSH keys.
- Integration with VirusTotal API to verify the safety of Openclaw Skills before execution.
- Strict enforcement of workspace boundaries to prevent skills from writing files outside of designated directories.
- Real-time warning system that provides developers with a safety summary before proceeding with installations.
SKILL.md
Loading
Related Openclaw Skills
Agente Português
An AI-driven specialist focused on Portuguese language, literature analysis, and high-performance essay writing for competitive exams like FUVEST.
VA Claims Assistant
A specialized AI assistant designed to guide U.S. military veterans through the entire VA disability claims lifecycle, from initial filing to Board of Veterans Appeals.
OpenAlgernon Orchestrator
The primary coordinator and command router for the OpenAlgernon AI-native personal study platform.
Automation Workflows
Design and implement seamless automation workflows to eliminate repetitive tasks and scale your business operations without increasing headcount.
Memory Management
A professional framework for AI agents to maintain long-term context and daily logs using structured Markdown storage.
History and Geography Agent
A specialized AI agent focused on mastering History and Geography for the FUVEST exam through deep contextual analysis and power dynamic mapping.
Featured*
