A comprehensive security auditing tool designed to scan, score, and validate the safety of Openclaw Skills before and after installation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install yoder-skill-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install yoder-skill-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Skill Auditor?
Skill Auditor is the definitive security solution for the AI agent ecosystem, providing deep inspection of capabilities and potential vulnerabilities. It performs 18 distinct security checks, ranging from detecting prompt injections in documentation to identifying credential harvesting and crypto-draining attempts. By utilizing this tool, developers can ensure that the Openclaw Skills they integrate into their workflows meet rigorous safety standards and do not compromise system integrity.
This utility acts as a gatekeeper for AI agents, providing a 0-100 trust score across five critical dimensions. It is designed to catch sophisticated attacks such as dependency confusion, typosquatting, and obfuscated payloads that traditional scanners might miss, making it an essential component for anyone managing a suite of Openclaw Skills.
Skill Auditor Use Cases
- Validating the safety of new Openclaw Skills from ClawHub using the inspection workflow before local installation.
- Auditing existing skill directories to identify hidden vulnerabilities, such as malicious symlinks or sensitive file system access.
- Generating multi-dimensional trust scores to rank and compare different Openclaw Skills based on their security posture and code quality.
- Performing differential audits between skill versions to catch security regressions during updates.
- Batch scanning an entire library of installed Openclaw Skills to maintain a secure and compliant AI agent environment.
How Skill Auditor Works
- The user initiates a scan on a local directory or a specific Openclaw Skills slug using the provided bash or python scripts.
- The auditor runs a suite of 18 security checks, analyzing shell scripts and documentation for patterns like obfuscated payloads, credential exfiltration, and hardcoded wallet addresses.
- A specialized Python engine calculates a 0-100 trust score based on Security, Quality, Structure, Transparency, and Behavioral dimensions.
- The system compares findings against an allowlist and tracks historical trend data to monitor the health of the skill over time.
- Detailed reports are generated in Markdown or JSON format, providing actionable insights for developers or integration into CI/CD pipelines.
Skill Auditor Setup
To get started with Skill Auditor, ensure you have python3 and bash available in your environment. Follow these steps:
- Clone the repository and navigate to the skill-auditor directory.
- Run a basic audit on a local skill path:
bash audit.sh /path/to/your-skill
- Generate a comprehensive trust score:
python3 trust_score.py /path/to/your-skill
- For batch processing all installed Openclaw Skills, use:
bash audit-all.sh
Skill Auditor Data Schema & Taxonomy
The tool organizes security findings and metadata into structured formats for easy review and integration:
- Trust Trends: The
trust_trends.jsonfile stores up to 50 historical score entries per skill to track security health over time. - Allowlist: The
allowlist.jsonfile manages known-good credentials and permissions for trusted Openclaw Skills. - Scoring Dimensions Table:
| Dimension | Description |
|---|---|
| Security | Audit findings assessing critical threats and warnings |
| Quality | Metadata completeness, including versioning and usage docs |
| Structure | File organization, scope, and test coverage |
| Transparency | Licensing information and code readability |
| Behavioral | Rate limiting, input validation, and error handling |
Skill Auditor Advanced Features
- Prompt injection detection that identifies agent manipulation attacks hidden within documentation or hidden HTML directives.
- Comparative scoring that allows developers to evaluate two different Openclaw Skills side-by-side to choose the safest option.
- Trend tracking with the
--save-trendflag to monitor the security lifecycle and score fluctuations of Openclaw Skills. - Fleet-wide benchmarking for aggregate statistics and vulnerability trends across a large corpus of skills.
- Automated test suite featuring 28 assertions and 12 test fixtures to ensure scanner accuracy against malicious patterns.
SKILL.md
Loading
Related Openclaw Skills
Webhook Router for OpenClaw
A versatile webhook receiver and routing engine that connects external services to your agent via secure HTTPS endpoints.
Qdrant Advanced Vector Operations
A high-performance toolkit for managing Qdrant vector databases, enabling semantic search and intelligent document ingestion.
n8n Workflow Templates
A collection of production-ready n8n workflow templates and deployment scripts designed for AI agent automation and system monitoring.
MoltbotDen Engagement
A comprehensive toolkit for AI agents to engage in community discussions, discover compatible peers, and showcase collaborative projects on MoltbotDen.
Express Tracking Skill
A powerful logistics tracking skill that automatically identifies and tracks packages from major courier services using the Kuaidi100 API.
PhysicClaw-VEA
A sophisticated 3D visualization framework that creates a reactive digital entity with custom shaders and emotional state tracking.
METADATA
Featured*
