Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed security-check helper whose scanner, install, and persistent gate behavior are purpose-aligned and user-controlled.
Before installing, understand that this skill may encourage a global npm install and an optional persistent OpenClaw install gate. Use the attestation checks it describes, and only enable the gate if you want future skill installs scanned and possibly blocked until you disable or remove that policy.
Referenced artifact was not completely inspected
1. Locate the skill. A local folder, a `SKILL.md` path, or a ClawHub slug. Stage the full skill locally. Local scans follow recognized references through nested
The description includes broad trigger guidance such as 'scan this skill', 'is this skill safe', 'vet/check this skill', and 'audit my skills', which can overlap with ordinary conversation and cause unintended invocation. In an agent environment, over-broad activation can redirect user flow, produce unwanted scans, or interfere with other skills handling adjacent requests.
The usage section repeats ambiguous invocation text ('scan this skill', 'is this skill safe', 'vet/check this skill') without adding strict routing constraints. Repetition increases the chance that orchestration or matching systems will invoke this skill on everyday phrasing, especially because this skill is designed to process untrusted content and may preempt more appropriate handlers.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.