Skill Auditor

Before you install any OpenClaw skill, run it through this six-step security review. It checks for typosquatting (missing characters, homoglyphs, scope confusion), over-privileged permission requests (network plus fileRead equals exfiltration risk), dependency vulnerabilities, prompt injection patterns, and data exfiltration signatures. The protocol is opinionated: it blocks combinations like network and shell together, flags base64-encoded instructions, and looks for references to credential files. You get a structured verdict with red flags and a safe-run plan. Treat it like a code review gate for third-party skills. Useful when someone shares a SKILL.md file or before pulling something from ClawHub, especially if the author is unknown or permissions changed between versions.

Install to Claude Code

npx -y skills add useai-pro/openclaw-skills-security --skill skill-auditor --agent claude-code