Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Static analysis tool that scans agent skill directories for security threats before installation. Detects credential theft patterns, suspicious network calls, destructive commands, and code obfuscation. Returns a safety rating (SAFE, CAUTION, SUSPICIOUS, or DANGEROUS) with specific findings per file.
Catches attack patterns specific to agent skill architectures, like env file exfiltration and eval-based obfuscation, that general-purpose linters miss.
When to use it
- Auditing a downloaded skill before moving it to the active skills folder
- Detecting hardcoded API keys or env file access in third-party skills
- Identifying outbound webhook or tunnel calls in untrusted skill code
- Scanning community-shared skills before running them locally
- Checking for privilege escalation or destructive commands in a new skill
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit the skill I downloaded to ~/Downloads/new-skill before I install it
- 1Run `python3 scripts/audit.py ~/Downloads/new-skill` against the target directory
- 2Scan source files for credential access patterns including .env and SSH key references
- 3Check for suspicious network calls such as webhook endpoints and ngrok or localtunnel usage
- 4Detect obfuscation techniques including eval, exec, and base64 decoding
- 5Compute a numerical risk score and assign an overall safety rating
Report showing status CAUTION, risk score, and a list of flagged patterns with the specific files and lines that triggered each warning