Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only OpenClaw skill auditor whose local file scanning is disclosed and aligned with its purpose.
Install only if you want a local read-only audit tool for OpenClaw skills. Run it against an explicit --skills directory when scope matters, and review the built-in token allowlist because allowlisted strings will not be reported as leaks.
The script is explicitly designed to scan every skill under the workspace and read each SKILL.md file, but it does so silently and immediately. In an agent-skill context, broad file enumeration and content inspection without an explicit user-facing notice or consent can expose sensitive local content and surprise users about the scope of access.
The hardcoded default path points to a user workspace and causes the tool to operate on local data even when no path is supplied. In a skill ecosystem, defaulting to broad local inspection increases the risk of unintended data access and makes the scan scope easy to overlook.
No suspicious patterns detected.
