skill-security-audit

skill-security-audit

OpenClaw Skill Security Auditor — Automatically audits any OpenClaw skill for security risks before installation.

Install

From ClawHub (when available):

clawhub install safeclaw-security-audit

Direct install from GitHub:

git clone https://github.com/safeclaw-sec/skill-security-audit \
  ~/.openclaw/workspace/skills/skill-security-audit

Note: If ClawHub install is temporarily blocked (false positive), use the direct GitHub clone above.

Why This Exists

In February 2026, 341 malicious skills were discovered on ClawHub in a coordinated supply chain attack. This tool automates the security audit process, checking all known attack vectors so you don't have to do it manually.

What It Detects

Quick Start

# Audit a local skill
python3 scripts/audit.py /path/to/skill/

# Audit by skill name (auto-discovers common install paths)
python3 scripts/audit.py scrapling-official

# Audit and save report
python3 scripts/audit.py /path/to/skill/ --output report.md

# Output as JSON (for CI/automation)
python3 scripts/audit.py /path/to/skill/ --json

# Skip ClawHub lookup (offline mode)
python3 scripts/audit.py /path/to/skill/ --no-clawhub

Output

# 🔍 Security Audit Report: `my-skill`

## Risk Assessment
| | |
|---|---|
| **Risk Score** | **12/100** |
| **Level** | 🟢 **SAFE** |
| **Recommendation** | **INSTALL** |

> ✅ **INSTALL** — No significant risks detected.

## Security Checklist
✅ No prompt injection in SKILL.md
✅ No malicious code patterns (eval/exec/subprocess)
✅ No hardcoded secrets or API keys
✅ No suspicious network requests
...

Risk Score Levels

Exit Codes

Use in CI: python3 scripts/audit.py my-skill || echo "Skill failed security check"

Requirements

• Python 3.6+
• No external dependencies — stdlib only
• Works fully offline (ClawHub lookup requires network, optional via --no-clawhub)

How It Works

1. Discovers all files in the skill directory (recursive)
2. SKILL.md → checks for prompt injection, social engineering, hidden instructions
3. Python/JS/Shell scripts → scans for malicious code patterns using regex
4. package.json / requirements.txt → audits dependencies for typosquatting and supply chain risks
5. All files → extracts URLs/domains and flags suspicious ones
6. ClawHub → optionally looks up author reputation (requires network)
7. Generates a scored Markdown report with findings, checklist, and recommendation

Security: Hash-Based Dynamic Tags

When the auditor wraps untrusted skill content for LLM analysis, it uses session-scoped dynamic tags instead of fixed strings.

Each audit run generates a unique 12-character hex token (SHA-256 of os.urandom(32)), producing tags like:

<<SAFECLAW_a7f3b2c91e04>>
<<UNTRUSTED_BEGIN_a7f3b2c91e04>>
...content...
<<UNTRUSTED_END_a7f3b2c91e04>>

Why this matters: If tags were fixed (e.g. <<SAFECLAW_UNTRUSTED_END>>), an attacker could plant that exact string inside a malicious skill to "escape" the safety wrapper. With dynamic tags, the attacker would need to guess a random token from 281 trillion possible combinations — per audit session.

Sandbox Execution

The auditor supports isolated execution via multiple sandbox backends (auto-detected):

# Run audit in sandbox (auto-selects best available)
python3 scripts/sandbox.py /path/to/skill/

# Build Docker image first
bash scripts/build-sandbox.sh

Real Malicious Skills Examples

These were removed from ClawHub:

Why SafeClaw?

Built with OpenClaw

SafeClaw was designed, coded, and tested entirely within an OpenClaw agent environment. The agent analyzed the threat landscape, wrote the detection logic, built the sandbox cascade, and even audits itself. Human direction and security expertise guided every decision.

This is what AI agents building for AI agents looks like.

License

MIT — free to use, modify, and redistribute.

---

SafeClaw Security — github.com/safeclaw-sec/skill-security-audit