openclaw-skill-eeta-audit
v1.0.0OpenClaw Skill quality audit based on CORE-EEAT framework adapted for AI agent skills. Evaluates skill's utility (task completion efficiency) and security (s...
⭐ 0· 41·0 current·0 all-time
byyaoo-2818@281862066-a11y
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the content: the SKILL.md and references describe an 80-item, multi-gate audit framework for OpenClaw skills. The skill requires no binaries, env vars, or installs, which is reasonable for an instruction-only auditing tool that operates by reading and evaluating skill metadata and files.
Instruction Scope
The instructions direct the agent to inspect SKILL.md files, scripts, references, and gating metadata and to scan for risky patterns (command injection, hardcoded secrets, path traversal, etc.). That behavior is expected for a security-audit skill, but it necessarily involves reading other skill files and code — so the operator should only point the auditor at repositories/files intended for review and avoid exposing directories containing unrelated secrets or credentials.
Install Mechanism
No install spec and no code files means nothing is written to disk and no external downloads occur. This is the lowest-risk installation model and is proportionate for an auditing/instruction-only skill.
Credentials
The skill declares no required environment variables or credentials. The included security checklist explicitly recommends gating on env and permissions when auditing other skills; the skill itself does not ask for unrelated secrets — this is proportionate.
Persistence & Privilege
Defaults allow autonomous invocation (disable-model-invocation: false) but always:false. Autonomous use is the platform default and not inherently problematic here. Operators should be aware that if given permission the agent could run audits automatically; that increases blast radius only if you allow it to access sensitive directories or supply secrets during audits.
Scan Findings in Context
[no-findings] expected: The static regex scanner had no code files to analyze (instruction-only skill). This is expected; absence of findings here is not a proof of safety, but consistent with an audit-only SKILL.md and reference docs.
Assessment
This skill appears coherent and appropriate for vetting OpenClaw skills. Before running it: (1) only point the auditor at repositories or directories intended for review — do not feed it directories containing secrets or unrelated system config; (2) avoid supplying real credentials or broad filesystem roots as inputs; (3) if you plan to allow autonomous/automatic audits, restrict which paths the agent can access and consider running audits in an isolated environment; (4) for high-risk or production skills, supplement this automated audit with a manual review of any scripts or binaries the target skill installs or downloads.Like a lobster shell, security has layers — review code before you run it.
latestvk978s6tqbsc8m6wwzq2erw975h842qzs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.