Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed OpenClaw skill-auditing helper with limited local file-reading and report-writing behavior, and no evidence of malicious code or exfiltration.
Install only if you are comfortable with the agent reading the skill files you ask it to audit and saving audit reports in your OpenClaw workspace. Review or clean the report directory if audited skills contain private instructions.
The trigger phrases include broad terms like audit, check, validate, and evaluate, which are common in unrelated workflows and can cause the skill to activate unexpectedly. Because the skill also instructs saving reports to disk and supports batch processing, accidental triggering has greater impact than a purely read-only skill.
The skill mandates writing audit reports to a fixed directory under the user's home folder, introducing persistent side effects beyond the core task of analyzing a SKILL.md file. This can surprise users, create unwanted local data retention, and enable bulk creation of files when triggered repeatedly or in batch mode.
The skill performs disk writes but does not surface that side effect in the user-facing description, undermining informed consent and making activation riskier. Hidden persistence is especially problematic for a skill expected to provide an evaluation response, not create files on the host automatically.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Version**: skill-audit v1.0
**Date**: 2026-05-21
**Target**: /home/node/.openclaw/workspace/skills/changelog/SKILL.md
**Type**: Documentation / Format Conversion
**N/A Dimensions**: E (Sub-Agent Design)
**Redistributed Weights**: A:24%, B:18%, C:24%, D:18%, F:16%
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Version**: skill-audit v1.0
**Date**: 2026-05-21
**Target**: /home/node/.openclaw/workspace/skills/scaffold/SKILL.md
**Type**: Code Generation / Modification
**N/A Dimensions**: E (Sub-Agent Design)
**Redistributed Weights**: A:24%, B:18%, C:24%, D:18%, F:16%
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Version**: skill-audit v1.0
**Date**: 2026-05-21
**Target**: /home/node/.openclaw/workspace/skills/screenshot-capture/SKILL.md
**Type**: Tool Integration
**N/A Dimensions**: C (Style Guide), E (Sub-Agent Design)
**Redistributed Weights**: A:30%, B:20%, D:20%, F:30%
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Version**: skill-audit v1.0
**Date**: 2026-05-21
**Target**: /home/node/.openclaw/workspace/skills/summarize/SKILL.md
**Type**: Sub-agent Pipeline
**N/A Dimensions**: None (all dimensions evaluated)
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Version**: skill-audit v1.0
**Date**: 2026-05-21
**Target**: /home/node/.openclaw/workspace/skills/unit-converter/SKILL.md
**Type**: Single Task
**N/A Dimensions**: C (Style Guide), E (Sub-Agent Design)
**Redistributed Weights**: A:30%, B:20%, D:20%, F:30%
This reference document is written entirely in Korean and includes Korean-specific scoring examples such as requiring Korean keywords alongside English ones. Because the file does not offer a language choice or explain that it is a Korea-specific or Korean-localized variant, it may violate the language/locale policy for skills that should not force a specific language without opt-in.
The rubric scores descriptions higher when they include both Chinese and English keywords, and marks an English-only description as lower scoring because Chinese keywords are missing. This is a natural-language locale policy preference embedded in the document, but it does not explain that the requirement is optional, user-selected, or limited to a justified region-specific context.
The manifest description focuses on evaluating a skill and producing scoring outputs, but the SKILL body expands the operational behavior to include persistent report generation in a workspace directory and batch auditing over folders. These are meaningful behavioral extensions beyond the concise manifest description, even though they are related to the broader audit function.
この markdown はファイル名の .ja.md と本文全体の記述から、日本語ロケール向けの内容を実質的に固定しています。地域限定・日本語限定である合理的な説明や、他言語利用者への選択肢が本文中に示されていないため、言語/ロケールの強制に関するポリシー違反として解釈される可能性があります。
No suspicious patterns detected.