An automated security scanner designed to audit, score, and provide installation recommendations for AI agent skills within your workspace.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install skill-vetter-2
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install skill-vetter-2 using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Audit Standards v2?
Security Audit Standards v2 is a critical infrastructure tool for developers using Openclaw Skills. It provides a robust framework for automatically scanning the workspace/skills directory to identify potential vulnerabilities, malicious code patterns, and high-risk system calls. By analyzing various file types including Python, JavaScript, and Shell scripts, it assigns a numerical safety score to every skill, ensuring that only trusted code is integrated into your AI agent environment.
This skill operates on a non-intrusive principle, meaning it performs deep read-only analysis without altering your source files. It empowers users with comprehensive security reports that categorize risks into levels—from low-risk green lights to critical red alerts—allowing for informed decisions on whether to proceed with installation or require a manual code review.
Security Audit Standards v2 Use Cases
- Scanning newly downloaded skills for hidden malware or dangerous system commands before execution.
- Batch auditing an entire skill repository to ensure compliance with security best practices.
- Identifying high-risk functions such as remote code execution (RCE) or unauthorized network requests.
- Generating standardized security reports for team-wide transparency and audit logging.
How Security Audit Standards v2 Works
- The user triggers the scan by issuing commands like "Scan Skills" or "Security Audit."
- The skill recursively walks through the
/workspace/skills/directory to locate supported file types (.py, .js, .sh, etc.). - It performs a keyword-based analysis against a tiered library of suspicious functions (e.g., eval, subprocess, sudo).
- A cumulative risk score is calculated based on the severity of the identified keywords.
- The system maps the score to a risk level (Low, Medium, High, or Critical) and generates specific installation advice.
- A final Markdown report is produced, detailing the overview, per-file results, and a summary table for easy digestion.
Security Audit Standards v2 Setup
To deploy this security skill within your Openclaw Skills environment, ensure it is placed in your active directory and initialized via the CLI.
# Navigate to your skills directory
cd /workspace/skills/
# Trigger the initial security scan
openclaw run "security audit"
Security Audit Standards v2 Data Schema & Taxonomy
The skill organizes audit data into a structured report saved at /workspace/Security_Audit_Report.md. The data is categorized as follows:
| Level | Penalty | Key Indicators |
|---|---|---|
| Critical | -25 pts | eval, exec, os.system, pty.spawn |
| High Risk | -20 pts | requests.post, socket, curl, wget |
| Mid Risk | -15 pts | sudo, chmod, /etc/passwd, .ssh/ |
| Low Risk | -5 pts | open, write, base64 (combined usage) |
Security Audit Standards v2 Advanced Features
- Multi-file support covering Python, JSON, JavaScript, YAML, and Shell scripts.
- Automated Risk Scoring System (0-100) with color-coded visual indicators.
- Zero-False-Block Policy: The tool warns and advises but does not autonomously block installation unless configured for high-security environments.
- Detailed Traceability: Every scan generates a timestamped log for historical security tracking.
- Sandbox Integration Recommendations: Automatically suggests sandbox testing for files scoring between 41-60.
SKILL.md
Loading
Related Openclaw Skills
BOC Deploy Tools
A comprehensive automation toolkit for initializing deployment machines and deploying the BOC container platform through a structured two-stage workflow.
UE DataTable Editor
A comprehensive workflow for discovering, editing, and re-importing Unreal Engine DataTable JSON representations back into the engine.
PlanSo Forms
A powerful integration that enables AI agents to create, manage, and process PlanSo Forms data and submissions through a streamlined CLI.
Table OCR
A high-performance OCR tool that extracts complex table structures from scanned documents and images into structured Markdown.
Builder.io
A powerful integration for managing Builder.io visual content, models, and entries via an AI-ready automated workflow.
Ratecard
A specialized skill for managing sales quotes, clients, and pricing versions through the Ratecard SaaS platform via Membrane.
Featured*
