Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runs structured security checks on skills from registries or shared sources before installation. Covers RCE patterns, malicious code, credential misuse, and mismatches between a registry listing and the skill's SKILL.md. Produces a 10-point report with a Benign or Suspicious verdict.
Rather than ad-hoc judgment, it applies a fixed 10-point checklist covering RCE, malicious code, credential scope, and registry consistency, always ending in a single clear verdict.
When to use it
- Checking a ClawHub skill for safety before installing it
- Reviewing a skill that requests OAuth or API key access
- Auditing all downloaded skills in a local skills directory
- Evaluating a skill shared via URL or file before granting credentials
- Self-checking an authored skill before publishing to a registry
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Run a security check on the gog-cli skill from ClawHub'
- 1Load the skill's SKILL.md and registry listing
- 2Check purpose vs capability alignment
- 3Scan for RCE patterns such as curl|sh, eval of remote input, and unvalidated command construction
- 4Scan for malicious code signs including obfuscation, exfiltration, secret reads, and backdoors
- 5Verify credential declarations and install mechanism consistency between registry and SKILL.md
10-point security report with a Benign or Suspicious verdict and 'What to consider before installing' guidance