Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Corrected misleading binary requirements (python3 is mandatory).
What This Skill Does
Analyzes a ClawHub skill's scripts, permissions, and metadata for security risks before you install it. Produces a trust score from 0 to 100, flags specific risky patterns with file locations, and gives a verdict and recommendation. Works with skill slugs or full ClawHub URLs.
Rather than manually reading every script in a skill repository, it automates pattern matching against a known risk reference and gives a scored verdict in one command.
When to use it
- Checking a community skill before installing it on a production machine
- Reviewing a colleague's shared skill before adding it to a shared workspace
- Auditing any skill that requests unusual file or network access
- Setting up an alias so every install triggers an automatic pre-check
- Investigating a flagged skill after a security incident report
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: "Is steipete/clawhub safe to install?"
- 1Run `bash scripts/audit.sh steipete/clawhub` against the target skill
- 2Scan all scripts and SKILL.md for HIGH, MEDIUM, and LOW risk patterns
- 3Calculate a trust score by applying per-pattern penalties
- 4Check whether the skill author is verified on ClawHub
- 5Format and return a structured JSON report with score, verdict, risks, and recommendation
Trust score of 72/100, verdict INSTALL WITH CAUTION, with a specific warning about an external curl call in scripts/sync.sh line 14 and a suggested inspection command.