Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Security audit and validation tools for the Agent Skills ecosystem. Scans skill packages for hardcoded credentials, dangerous file access patterns, external network requests, and Git history secrets. Built after a credential stealer was found in a community skill package.
Unlike generic static analysis tools, this is tailored to the Agent Skills package format and catches the specific attack patterns agents are most vulnerable to due to their trusting execution model.
When to use it
- Auditing a third-party skill for hardcoded API keys before installation
- Scanning a skill's Git history for accidentally committed secrets
- Checking file permissions on credential files in a skill package
- Detecting dangerous access patterns targeting ~/.ssh or ~/.aws directories
- Validating that a skill reads credentials from environment variables instead of source files
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Check this skill package for security issues before I install it
- 1Run skill-security-audit.sh against the target skill directory
- 2Scan source files for hardcoded API keys, passwords, and tokens
- 3Check for file access patterns targeting ~/.ssh, ~/.aws, or ~/.config
- 4Inspect Git history for previously committed secrets
- 5Report pass/fail status for each check category
A security audit report listing results for each check, with details on any detected vulnerabilities or confirmation that none were found