Security Audit
PassAudited by ClawScan on May 10, 2026.
Overview
The visible artifacts describe a purpose-aligned local security auditing tool, with only user-directed local scanning and manual install steps worth noticing.
This skill appears reasonable for auditing downloaded code, but use it narrowly: run it inside the specific folder you want checked, avoid scanning your whole home directory, and do not treat a “passed” result as a complete antivirus guarantee.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If run from a home directory or large workspace, it may inspect many private local files and print their paths in the local report.
The scanner recursively enumerates and reads files under the selected directory, which is expected for a local security audit but can cover more files than intended if run from a broad location.
for filepath in directory.rglob('*'): ... if is_text_file(filepath): ... suspicious = scan_text_file(filepath)Run it from the specific downloaded repository or folder you want to audit, and review reports before sharing them.
Installing this way changes files in your local OpenClaw skills directory and may not match every OpenClaw installation layout.
The README documents a manual installation path and permission change even though the registry metadata lists no install spec. The step is explicit and user-directed, but it modifies the local OpenClaw skills installation.
cp -r security-audit ~/.nvm/versions/node/v22.16.0/lib/node_modules/openclaw/skills/ ... chmod +x .../security-audit/audit.py
Prefer the normal trusted installation mechanism when available, or manually verify the copied files and destination path before making the script executable.