- name
- skill-audit
- description
- Security scanner for OpenClaw skills. Analyzes skill folders and .skill files for: prompt injection, data exfiltration, malicious scripts, suspicious network connections, dangerous code patterns, and unauthorized access. Use when: (1) BEFORE installing any skill from ClawHub or the internet — always scan first, (2) auditing an already-installed skill, (3) reviewing a skill's security posture, (4) checking what APIs/MCPs/env vars a skill uses, or (5) the user asks 'is this skill safe?'. IMPORTANT: This skill acts as a pre-install security hook. When the clawhub skill is used to install a new skill, ALWAYS run skill-audit on the installed skill BEFORE confirming success to the user.
Skill Audit — Security Scanner for OpenClaw Skills
Pre-install security hook. Scan skills before trusting them.
Pre-Install Hook Workflow (MANDATORY)
When any new skill is installed via clawhub install, follow this workflow:
- Let
clawhub install <slug>run (it downloads toskills/or~/.openclaw/skills/) - Immediately scan the installed skill:
python3 {baseDir}/scripts/scan_skill.py <path-to-installed-skill> --json- Read the JSON output and check
overall_risk - Report to the user based on risk:
- 🟢 Low: "🛡 Skill <name> gescannt: sicher. Keine verdaechtigen Patterns gefunden." - 🟡 Medium: "🛡 Skill <name>: pruefenswert. [N] Findings (z.B. liest API Keys, macht HTTP Requests). Details: [kurze Liste]. Willst du ihn trotzdem aktivieren?" - 🔴 High: "⚠️ Skill <name>: riskant! [Findings auflisten]. Empfehlung: Nur in Sandbox ausfuehren. Behalten oder loeschen?" - ⛔ Critical: "🚨 Skill <name>: GEFAEHRLICH! [Top-Findings]. Empfehlung: Sofort loeschen. Soll ich ihn entfernen?"
- If critical: offer to delete the skill folder immediately
- If user confirms deletion:
rm -rf <skill-path>
Manual Scan
python3 {baseDir}/scripts/scan_skill.py <path-to-skill>JSON output:
python3 {baseDir}/scripts/scan_skill.py <path-to-skill> --jsonAccepts skill folders (containing SKILL.md) and packaged .skill files.
Bulk Scan (all installed skills)
Scan every skill in a directory:
for d in ~/.openclaw/skills/*/; do
python3 {baseDir}/scripts/scan_skill.py "$d"
echo ""
doneWhat It Detects
- Prompt Injection — hidden instructions, identity overrides, audit evasion, invisible unicode, HTML comments
- Data Exfiltration — base64+POST, reverse shells, data capture services (webhook.site, requestbin)
- Dangerous Code — eval/exec, dynamic imports, unsafe deserialization, subprocess, raw sockets
- File System Abuse — path traversal, SSH key access, system files, OpenClaw config
- Network Connections — URL extraction + classification, hardcoded IPs, known API endpoints
- Secret Access — env var reads, API key references, credential patterns
- Permission Scope — required binaries, env vars, network-capable tools
Risk Levels
- 🟢 Low — no concern
- 🟡 Medium — review, could be legitimate
- 🔴 High — likely dangerous, review carefully
- ⛔ Critical — almost certainly malicious
Limitations
Static analysis catches patterns, not intent. Cannot detect:
- Logic-level attacks (subtly biased outputs)
- Obfuscated code beyond known patterns
- Runtime-only behavior (code fetched from URL then executed)
Combine with manual review for high-stakes deployments.
Source Code
GitHub: https://github.com/ProduktEntdecker/skill-audit