Security Audit Toolkit

• Analyzed: May 12, 2026, 3:22 AM
• Findings: 1
• Version: 1.0.0
• Hash: 78b51db9e4c2f30ffab422faba7c5a07cc6b80cfdb4dc264973c42aed9b654cc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle 'security-audit-toolkit' is classified as benign. All commands and scripts provided in SKILL.md, including the comprehensive `security-audit.sh` script, are directly aligned with the stated purpose of performing security audits. The skill utilizes standard security tools and practices (e.g., `npm audit`, `pip-audit`, `grep` for secrets, `openssl` for TLS checks, `find` for permissions) to identify vulnerabilities within a project. There is no evidence of intentional harmful behavior such as data exfiltration to unauthorized external endpoints, malicious execution of remote payloads, persistence mechanisms, or prompt injection attempts against the agent to subvert its intended function. The commands that access sensitive areas (like `~/.ssh`) are for auditing permissions, not for exfiltrating data, and network calls use placeholder domains like `example.com`.