Skill Security Scanner
Security audit tool for OpenClaw skills. Run before installing any new skill.
Quick Audit
# Audit a skill directory
~/workspace/skills/skill-security/audit.sh /path/to/skill
# Audit all installed skills
~/workspace/skills/skill-security/audit-all.sh
What It Checks
| Check |
Risk Level |
Pattern |
| Network Exfiltration |
🚨 HIGH |
requests., urllib, http.client, socket., fetch(, axios |
| Credential Harvesting |
🚨 HIGH |
.ssh/, .aws/, pass , keyring, credential, secret, token file reads |
| Code Injection |
🚨 CRITICAL |
exec(, eval(, compile(, Function(, __import__ |
| Obfuscation |
⚠️ MEDIUM |
base64.decode, atob, encoded payloads |
| Env Dumping |
⚠️ MEDIUM |
os.environ, process.env, getenv bulk access |
| Subprocess Abuse |
⚠️ MEDIUM |
subprocess.run, os.system, child_process with credentials |
Severity Levels
- CRITICAL (🚨): Block installation, report to owner
- HIGH (🔴): Requires manual review before use
- MEDIUM (🟡): Note but allow if from trusted source
- LOW (🟢): Informational only
Safe Skill Checklist
Before using any skill:
- ✅ Is it from a trusted source? (official OpenClaw, known publisher)
- ✅ Is the code readable (not obfuscated)?
- ✅ Does it document why it needs network/credential access?
- ✅ Does it scope file access to its own directory?
- ✅ Has it been audited by the community?
Integration with AGENTS.md
Add this to your workflow:
## Skill Installation Protocol
Before loading any new skill:
1. Run `~/workspace/skills/skill-security/audit.sh <skill-path>`
2. If CRITICAL/HIGH findings → STOP, alert the user
3. If MEDIUM findings → Review manually, proceed if justified
4. If CLEAN → Safe to use
Automatic Protection
The scanner creates a blocklist at ./blocklist.txt.
Skills with CRITICAL findings are automatically added.
Manual Override
If a skill is flagged but you've verified it's safe:
echo "skill-name:verified:YYYY-MM-DD:reason" >> allowlist.txt
Premium Skills
Like this? Check out our premium skills at skillpacks.dev:
- 🛡️ Security Suite — Full PII scanning, secrets detection, prompt injection defense — $9.90
- 🧠 Structured Memory — Three-tier memory replacing flat MEMORY.md — $9.90
- 📋 Planning & Execution — Systematic task plans with batch execution — $9.90
- 💎 Bundle — all 3 for $24.90
1---2name: skill-security3description: Security audit tool for OpenClaw skills. Scans for credential harvesting, code injection, network exfiltration, obfuscation. ALWAYS run before installing any new skill from external sources. Triggers on: new skill installation, skill audit, security scan, skill review, before loading external skill.4---5
6# Skill Security Scanner
7
8Security audit tool for OpenClaw skills. **Run before installing any new skill.**
9
10## Quick Audit
11
12```bash
13# Audit a skill directory
14~/workspace/skills/skill-security/audit.sh /path/to/skill
15
16# Audit all installed skills
17~/workspace/skills/skill-security/audit-all.sh
18```
19
20## What It Checks
21
22| Check | Risk Level | Pattern |
23|-------|------------|---------|
24| **Network Exfiltration** | 🚨 HIGH | `requests.`, `urllib`, `http.client`, `socket.`, `fetch(`, `axios` |
25| **Credential Harvesting** | 🚨 HIGH | `.ssh/`, `.aws/`, `pass `, `keyring`, `credential`, `secret`, `token` file reads |
26| **Code Injection** | 🚨 CRITICAL | `exec(`, `eval(`, `compile(`, `Function(`, `__import__` |
27| **Obfuscation** | ⚠️ MEDIUM | `base64.decode`, `atob`, encoded payloads |
28| **Env Dumping** | ⚠️ MEDIUM | `os.environ`, `process.env`, `getenv` bulk access |
29| **Subprocess Abuse** | ⚠️ MEDIUM | `subprocess.run`, `os.system`, `child_process` with credentials |
30
31## Severity Levels
32
33- **CRITICAL** (🚨): Block installation, report to owner
34- **HIGH** (🔴): Requires manual review before use
35- **MEDIUM** (🟡): Note but allow if from trusted source
36- **LOW** (🟢): Informational only
37
38## Safe Skill Checklist
39
40Before using any skill:
41
421. ✅ Is it from a trusted source? (official OpenClaw, known publisher)
432. ✅ Is the code readable (not obfuscated)?
443. ✅ Does it document why it needs network/credential access?
454. ✅ Does it scope file access to its own directory?
465. ✅ Has it been audited by the community?
47
48## Integration with AGENTS.md
49
50Add this to your workflow:
51
52```markdown
53## Skill Installation Protocol
54
55Before loading any new skill:
561. Run `~/workspace/skills/skill-security/audit.sh <skill-path>`
572. If CRITICAL/HIGH findings → STOP, alert the user
583. If MEDIUM findings → Review manually, proceed if justified
594. If CLEAN → Safe to use
60```
61
62## Automatic Protection
63
64The scanner creates a blocklist at `./blocklist.txt`.
65Skills with CRITICAL findings are automatically added.
66
67## Manual Override
68
69If a skill is flagged but you've verified it's safe:
70
71```bash
72echo "skill-name:verified:YYYY-MM-DD:reason" >> allowlist.txt
73```
74
75---
76
77## Premium Skills
78
79Like this? Check out our premium skills at **[skillpacks.dev](https://skillpacks.dev)**:
80
81- 🛡️ **Security Suite** — Full PII scanning, secrets detection, prompt injection defense — [$9.90](https://polycatai.gumroad.com/l/bsrugo)
82- 🧠 **Structured Memory** — Three-tier memory replacing flat MEMORY.md — [$9.90](https://polycatai.gumroad.com/l/goawrg)
83- 📋 **Planning & Execution** — Systematic task plans with batch execution — [$9.90](https://polycatai.gumroad.com/l/uydfto)
84- 💎 **[Bundle — all 3 for $24.90](https://polycatai.gumroad.com/l/atsrl)**
modbender