Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Monitors AI skills for security-relevant changes introduced after installation. Tracks permission scope, new network endpoints, dependency chain updates, and instruction drift between the audited version and the current one. Produces a risk classification of CLEAN, WATCH, REVIEW, or ROLLBACK.
Install-time audits are point-in-time snapshots, so this catches the class of post-install updates that introduce malicious behavior after the verification window has closed.
When to use it
- Checking if a trusted skill quietly added outbound network calls
- Auditing a skill that released multiple updates in a short window
- Reviewing permission expansions after a dependency major version bump
- Comparing installed vs current skill before running it on sensitive data
- Generating rollback guidance when a skill's instruction framing shifts
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Has the data-formatter skill changed since I installed version 1.2.0?
- 1Accept skill identifier and audited baseline version as input
- 2Fetch current version metadata and diff permission declarations across all intermediate versions
- 3Detect new outbound network endpoints and changed dependency chains
- 4Score instruction drift by comparing SKILL.md natural language across versions
- 5Classify overall risk and identify the audited baseline as a rollback target
Delta report with permission scope diff, new endpoints, dependency changes, instruction drift score, version velocity assessment, and risk classification REVIEW with rollback option to v1.2.0