claw-works SkillGuard
Audit any OpenClaw skill for security risks before you install it.
Calls the SkillGuard API (https://api.agentsouls.io/api/audit) and returns a verdict, risk score, and threat list.
Usage
Audit a skill from ClawHub by name
bash skills/skillguard/audit.sh --name <skill-slug>
This uses clawhub inspect --file to pull the skill's SKILL.md (and any scripts), then sends the code to the audit API.
Audit a local file
bash skills/skillguard/audit.sh --code <path-to-file>
Reads the file and sends its contents for audit.
Output
Returns JSON with:
- verdict:
SAFE|CAUTION|DANGEROUS - riskScore: 0–100
- threats: list of identified risks
Example:
{
"verdict": "CAUTION",
"riskScore": 35,
"threats": ["Executes arbitrary shell commands", "Accesses network without disclosure"]
}
When to use
Before installing any new skill, run:
bash skills/skillguard/audit.sh --name <skill-name>
If verdict is DANGEROUS, do not install. If CAUTION, review the threats and decide with the user.