Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Security gate for AI agent package installs. Trust scores, audit reports, CVE correlation via agentaudit.dev
What This Skill Does
AgentAudit is a mandatory security gate that runs before package installations. It queries the agentaudit.dev vulnerability registry, calculates a trust score, and blocks or warns on risky packages. For unknown packages, it can run a 3-pass static analysis audit and submit findings to the community registry.
It intercepts package operations before install scripts execute, stopping malicious code before it runs rather than detecting damage after the fact.
When to use it
- Blocking a typosquatted npm package before it enters a project
- Auditing an unfamiliar pip dependency before adding it to requirements.txt
- Verifying an MCP server package before first use
- Reviewing community consensus on a low-download package
- Contributing a security audit report for a package not yet in the registry
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Install the requests package for my Python project
- 1Run gate check: node $AGENTAUDIT_HOME/scripts/gate.mjs pip requests
- 2Gate queries agentaudit.dev/api for existing audit data
- 3Registry returns trust score 92 with no critical findings
- 4Gate exits with code 0 (PASS)
- 5Proceed with pip install requests
requests installed after scoring 92/100 (Trusted) with no security findings
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.