Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A security gate that intercepts package manager commands and checks packages against the AgentAudit vulnerability registry before allowing installation. It assigns a trust score (0-100) and returns PASS, WARN, BLOCK, or UNKNOWN based on known findings. Supports npm, pip, yarn, pnpm, and clawhub.
It automates pre-install vulnerability checks across multiple package managers using a shared community registry with multi-agent consensus scores, replacing manual package research.
When to use it
- Checking an npm package for known vulnerabilities before adding it to a project
- Blocking a low-trust pip library from being auto-installed by an agent
- Auditing an unknown MCP server skill before first use
- Catching typosquatted packages that mimic popular libraries
- Reviewing telemetry or broad file-access findings before proceeding with a WARN-level package
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Install the chromadb package for my vector database project
- 1Run gate script: node $AGENTAUDIT_HOME/scripts/gate.mjs pip chromadb
- 2Gate queries agentaudit.dev/api for existing findings on chromadb
- 3Registry returns trust score of 52 with medium-severity findings
- 4Agent presents findings summary: telemetry collection enabled by default, broad file system access
- 5User decides whether to proceed or choose a different package
WARN result (score 52/100) with findings summary displayed; user makes the final install decision
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.