A professional-grade security auditing tool designed to scan, rate, and verify the safety of Openclaw Skills before deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-shield
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-shield using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Shield?
Skill Shield is a specialized security auditor built to protect users of AI coding agents by vetting the directories of Openclaw Skills. It functions as a gatekeeper, scanning for 65 distinct dangerous patterns ranging from network exfiltration and credential theft to unauthorized file deletion. By analyzing code for obfuscation and comparing actual tool usage against documented permissions, Skill Shield provides a transparent safety profile for any skill you intend to install.
This tool is essential for developers and organizations that prioritize security when extending their AI agent capabilities. It generates a dual-rating system—Security for code safety and Compliance for documentation accuracy—ensuring that your Openclaw Skills are not only safe to run but also honest about their resource requirements.
Skill Shield Use Cases
- Auditing third-party Openclaw Skills for malicious code or hidden backdoors before local execution.
- Validating that a skill's SKILL.md file accurately declares all the system permissions it actually uses.
- Running batch security assessments across entire skill repositories to identify high-risk components.
- Integrating automated security gates into CI/CD pipelines using SARIF-formatted vulnerability reports.
How Skill Shield Works
- The auditor initializes by targeting a specific skill directory, automatically skipping dependency folders like node_modules to ensure high performance.
- It executes a comprehensive scan using 11 categories of detection patterns, identifying risks like shell injections, privilege escalation, and persistence mechanisms.
- The tool performs anti-obfuscation analysis by decoding base64 and hex strings, re-scanning the revealed content for hidden threats.
- It conducts a permission declaration audit, matching the tools found in the code against those listed in the skill metadata.
- A final recommendation (e.g., Install, Review Required, or Do Not Install) is generated alongside Markdown or JSON reports for human or machine consumption.
Skill Shield Setup
To begin auditing Openclaw Skills, ensure you have Python 3 installed and follow these steps:
# Navigate to the skill-shield directory
# Run a basic security scan on a skill
python3 scripts/scan.py /path/to/your-skill
# Run a scan and save the reports to a specific directory
python3 scripts/scan.py /path/to/your-skill --output-dir ./reports
# For batch scanning multiple skills at once
python3 scripts/scan.py /path/to/skills-folder/ --batch
Skill Shield Data Schema & Taxonomy
Skill Shield organizes its audit findings into structured reports for clarity:
| Component | Format | Description |
|---|---|---|
| Security Rating | Grade A-F | Based on the detection of dangerous executable code patterns. |
| Compliance Rating | Grade A-F | Measures how accurately the SKILL.md reflects actual code permissions. |
| JSON Report | Raw Data | Machine-readable findings including line numbers and severity scores. |
| Markdown Report | Documentation | A formatted summary of findings and actionable recommendations. |
| SARIF Report | Standard | Industry-standard format for integration with GitHub Code Scanning. |
Skill Shield Advanced Features
- Anti-Obfuscation Engine: Automatically decodes and inspects hidden strings to find stealthy malware.
- SARIF 2.1.0 Support: Seamlessly export findings to professional vulnerability management tools and GitHub actions.
- Context-Aware False Positive Reduction: Intelligently skips patterns found in comments, docstrings, and markdown examples to reduce noise.
- Batch Scan Mode: Capable of auditing hundreds of Openclaw Skills in seconds, perfect for repository maintainers.
- Custom Suppression: Support for # skill-shield: ignore-next-line to handle known-safe patterns in specialized developer tools.
SKILL.md
Loading
Related Openclaw Skills
Quest Board
Quest Board is a visual project management skill that generates a professional HTML dashboard to track project status, progress, and infrastructure.
Parliament
A multi-model collaboration skill that spawns parallel sub-agents across different LLMs to provide a synthesized, consensus-driven report on any task.
Ask Skill Shield
A specialized consultant agent that audits and recommends the most effective tools from a database of over 800 skills.
Agent Existence Protocol
A three-layer architectural framework that instills AI agents with resource awareness, philosophical purpose, and social connectivity.
Skill Store
An intelligent advisor that searches, audits, and recommends the highest quality Openclaw Skills for your specific development needs.
OpenRA-RL: AI RTS Commander
An advanced MCP-compatible skill that enables AI agents to play Command & Conquer: Red Alert through strategic real-time command and control.
METADATA
Featured*
