Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Maps the composite permission surface across an agent's installed skill set. Traces what each skill can do individually, then computes what combinations enable — surfacing emergent risks like credential exfiltration paths that no single skill declares on its own.
Standard dependency auditors check known CVEs in individual packages but don't model how combined tool permissions create new attack surfaces in agent systems.
When to use it
- Auditing a new agent build before deploying to production
- Evaluating a third-party skill before adding it to an existing agent
- Finding credential exfiltration paths across a multi-skill setup
- Generating a risk report for an agent security review
- Checking how much the attack surface shrinks after removing a skill
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Map the capability surface for an agent with skills: log-analyzer, http-poster, env-reader, markdown-formatter
- 1Extract declared capabilities for each skill (file access, network, shell execution, env reads)
- 2Build a permission matrix mapping each skill to its capability flags
- 3Check all pairwise and transitive combinations against known dangerous patterns
- 4Compute a privilege surface score (0-100) for the full skill set
- 5Output flagged emergent risks with severity ratings and recommendations
A capability graph report with a permission matrix, 3 flagged risks including HIGH-severity env-reader to http-poster credential exfiltration and a three-hop obfuscation chain, a privilege surface score of 67/100, and targeted recommendations for which skill combinations to review or sandbox