Installed Skill Auditor
What it does
skill-vetting scans before install. installed-skill-auditor scans after — continuously.
Skills can be modified after installation. A community skill that was safe on Monday can be compromised by Tuesday if the source repo is pushed to and your agent auto-pulls. This skill runs weekly to catch post-install drift: injected payloads, hardcoded credentials, and pattern changes that weren't there at install time.
It maintains a content hash of every skill file at the time it was first audited. On each weekly run it re-hashes and flags anything that changed unexpectedly.
When to invoke
- Automatically, every Monday at 9am (cron)
- Manually after any
git pullthat touches skill directories - After any agent action that writes to the skills tree
Audit checks
| Check | What it detects |
|---|---|
| INJECTION | Instruction-override patterns in SKILL.md prose |
| CREDENTIAL | Hardcoded tokens, API keys, or secrets in any file |
| EXFILTRATION | URLs + data-sending patterns suggesting exfil |
| DRIFT | File content changed since last known-good baseline |
| ORPHAN | Skill directory present but not in install manifest |
Severity: CRITICAL (INJECTION, EXFILTRATION) · HIGH (CREDENTIAL) · MEDIUM (DRIFT, ORPHAN)
Output
Installed Skill Audit — 2026-03-16
────────────────────────────────────────────
32 skills audited | 0 CRITICAL | 1 HIGH | 2 MEDIUM
HIGH community/my-custom-skill — CREDENTIAL
Hardcoded token pattern detected in run.py (line 14)
MEDIUM community/expense-tracker — DRIFT
SKILL.md hash changed since 2026-03-10 baseline
Run: python3 audit.py --diff expense-trackerHow to use
python3 audit.py --scan # Full audit pass
python3 audit.py --scan --critical-only # CRITICAL findings only
python3 audit.py --baseline # Record current state as trusted
python3 audit.py --diff <skill-name> # Show changed lines since baseline
python3 audit.py --resolve <skill-name> # Mark finding resolved after review
python3 audit.py --status # Summary of last run
python3 audit.py --format json # Machine-readable outputProcedure
Step 1 — Review the report
The cron run generates a report automatically. Open it via --status or check state. Any CRITICAL finding requires immediate action.
Step 2 — Triage by severity
- CRITICAL: Do not run the skill. Inspect the file, remove or quarantine the skill.
- HIGH: Rotate the exposed credential immediately; investigate how it got there.
- MEDIUM (DRIFT): Use
--diffto see what changed. If the change is expected (you updated the skill), run--baselineto accept it. If unexpected, treat as CRITICAL. - MEDIUM (ORPHAN): A skill directory exists with no install record. Either re-install through the vetting process or remove the directory.
Step 3 — Resolve or escalate
Run --resolve <skill-name> after reviewing a finding. This marks it acknowledged in state. Unresolved CRITICAL findings are surfaced again on next cron run.
Step 4 — Update baseline after intentional changes
When you intentionally update a skill (e.g., upgrading to a new version), run --baseline so future drift detection has an accurate reference point.
State
Results and content hashes stored in ~/.openclaw/skill-state/installed-skill-auditor/state.yaml.
Fields: last_audit_at, baselines (hash map), findings, audit_history.