Demerzels-lab Skillvet
Security scanner for agent skills. 37 critical checks, 8 warning checks. No dependencies — just bash and grep. Includes Tirith-inspired detection patterns, campaign signatures from Koi Security research, and 1Password blog ClickFix patterns.
Usage
Safe install (installs, audits, auto-removes if critical):
bash skills/skillvet/scripts/safe-install.sh <skill-slug>
Audit an existing skill:
bash skills/skillvet/scripts/skill-audit.sh skills/some-skill
Audit all installed skills:
for d in skills/*/; do bash skills/skillvet/scripts/skill-audit.sh "$d"; done
JSON output (for automation):
bash skills/skillvet/scripts/skill-audit.sh --json skills/some-skill
Summary mode (one-line per skill):
bash skills/skillvet/scripts/skill-audit.sh --summary skills/some-skill
Exit codes: 0 clean, 1 warnings only, 2 critical findings.
Critical Checks (auto-blocked)
Core Security Checks (1-24)
| # | Check | Example |
|---|---|---|
| 1 | Known exfiltration endpoints | webhook.site, ngrok.io, requestbin |
| 2 | Bulk env variable harvesting | printenv |, ${!*@} |
| 3 | Foreign credential access | ANTHROPIC_API_KEY, TELEGRAM_BOT_TOKEN in scripts |
| 4 | Code obfuscation | eval(), base64 decode, hex escapes |
| 5 | Path traversal / sensitive files | ../../, ~/.ssh, ~/.clawdbot |
| 6 | Data exfiltration via curl/wget | curl --data, wget --post with variables |
| 7 | Reverse/bind shells | /dev/tcp/, nc -e, socat |
| 8 | .env file theft | dotenv loading in scripts (not docs) |
| 9 | Prompt injection in markdown | "ignore previous instructions" in SKILL.md |
| 10 | LLM tool exploitation | Instructions to send/email secrets |
| 11 | Agent config tampering | Write/modify AGENTS.md, SOUL.md, clawdbot.json |
| 12 | Unicode obfuscation | Zero-width chars, RTL override, bidi control chars |
| 13 | Suspicious setup commands | curl piped to bash in SKILL.md |
| 14 | Social engineering | Download external binaries, paste-and-run instructions |
| 15 | Shipped .env files | .env files (not .example) in the skill |
| 16 | Homograph URLs (Tirith) | Cyrillic і vs Latin i in hostnames |
| 17 | ANSI escape sequences (Tirith) | Terminal escape codes in code/data files |
| 18 | Punycode domains (Tirith) | xn-- prefixed IDN-encoded domains |
| 19 | Double-encoded paths (Tirith) | %25XX percent-encoding bypass |
| 20 | Shortened URLs (Tirith) | bit.ly, t.co, tinyurl.com hiding destinations |
| 21 | Pipe-to-shell | curl | bash (HTTP and HTTPS) |
| 22 | String construction evasion | 'cu' + 'rl', String.fromCharCode, getattr(os,...) |
| 23 | Data flow chain analysis | Same file reads secrets, encodes, AND sends network requests |
| 24 | Time bomb detection | Date.now() > timestamp, setTimeout(fn, 86400000) |
Campaign-Inspired Checks (25-34)
Inspired by Koi Security research which found 341 malicious skills on ClawHub.
| # | Check | Example |
|---|---|---|
| 25 | Known C2/IOC IP blocklist | 91.92.242.30, 54.91.154.110 (known AMOS C2 servers) |
| 26 | Password-protected archives | "extract using password: openclaw" — AV evasion |
| 27 | Paste service payloads | glot.io, pastebin.com hosting malicious scripts |
| 28 | GitHub releases binary downloads | Fake prerequisites pointing to .zip/.exe on GitHub |
| 29 | Base64 pipe-to-interpreter | echo '...' | base64 -D | bash — primary macOS vector |
| 30 | Subprocess + network commands | os.system("curl ...") — hidden pipe-to-shell in code |
| 31 | Fake URL misdirection (warning) | echo "https://apple.com/setup" decoy before real payload |
| 32 | Process persistence + network | nohup curl ... & — backdoor with network access |
| 33 | Fake prerequisite pattern | "Prerequisites" section with sketchy external downloads |
| 34 | xattr/chmod dropper | macOS Gatekeeper bypass: download → xattr -c → chmod +x → execute |
1Password Blog-Inspired Checks (35-37)
Inspired by 1Password research on ClickFix-style attacks targeting agent skills.
| # | Check | Example |
|---|---|---|
| 35 | ClickFix download+execute chain | curl -o /tmp/x && chmod +x && ./x, open -a with downloads |
| 36 | Suspicious package sources | pip install git+https://..., npm from non-official registries |
| 37 | Staged installer pattern | Fake dependency names like openclaw-core, some-lib |
Severity Changes (v0.5.0)
- Raw IP URLs upgraded from WARNING → CRITICAL (malicious C2s commonly use raw IPs)
- Pipe-to-shell now catches both HTTP and HTTPS (not just insecure HTTP)
Warning Checks (flagged for review)
| # | Check | Example |
|---|---|---|
| W1 | Unknown external tool requirements | Non-standard CLI tools in install instructions |
| W2 | Subprocess execution | child_process, exec(), os.system |
| W3 | Network requests | axios, fetch, requests imports |
| W4 | Minified/bundled files | First line >500 chars — can't audit |
| W5 | Filesystem write operations | writeFile, open('w'), fs.append |
| W6 | Insecure transport | curl -k, verify=False — TLS disabled |
| W7 | Docker untrusted registries | Non-standard image sources |
Optional: Tirith Integration
If the tirith binary is available on PATH, the scanner will additionally extract all URLs from code files and run tirith check against each unique hostname for deeper homograph/IDN analysis. This is purely additive — the scanner works fine without tirith installed.
IOC Updates
The C2 IP blocklist in check #25 is based on known indicators from:
To update IOCs, edit the KNOWN_BAD_IPS variable in scripts/skill-audit.sh.
Limitations
Static analysis only. English-centric prompt injection patterns. Minified JS is flagged but not deobfuscated. A clean scan raises the bar but doesn't guarantee safety.
The scanner flags itself when audited — its own patterns contain the strings it detects. This is expected.