Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Updated scripts/audit.py with changes for version 1.1.0. - No user-facing or documentation changes.
What This Skill Does
Runs a full security audit of all installed OpenClaw skills in a single pass. Chains arc-skill-scanner, arc-trust-verifier, and SHA-256 binary integrity checks, then outputs a prioritized risk report with per-skill trust scores. Optionally generates trust attestations for skills that pass all checks.
Replaces running arc-skill-scanner, arc-trust-verifier, and binary checks separately, so nothing is skipped and findings are consolidated into one ranked report.
When to use it
- Auditing all installed skills before deploying an agent to production
- Checking a newly added third-party skill for suspicious code or binaries
- Exporting a JSON audit report for a compliance or security review
- Identifying which installed skills have the highest risk scores at a glance
- Generating trust attestations for skills that pass all verification steps
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: audit all my installed skills and flag anything critical
- 1Runs arc-skill-scanner patterns across every installed skill directory
- 2Assesses provenance and code cleanliness for each skill via arc-trust-verifier
- 3Verifies binary integrity using SHA-256 checksums
- 4Ranks all findings by severity and builds a per-skill breakdown
- 5Surfaces critical actions that require immediate attention
A report listing total skills scanned, severity counts, overall risk level, per-skill trust scores with recommendations, and a critical actions section