Skill Audit
v1.0.0Automatically audits newly installed skills to validate structure, security, and health before activation, preventing broken or malicious skills from running.
⭐ 0· 66·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, SKILL.md, and the included audit.sh are consistent: the skill is an on-disk auditor for other skills. It declares no env vars, binaries, or install steps that would be unrelated to this purpose.
Instruction Scope
SKILL.md instructs running the provided audit script against a target skill path. The script only reads files under the given directory, searches for common secret patterns, checks permissions, and reports results — it does not perform network exfiltration or require external services. Note: there are minor implementation bugs (a grep regex with a negative lookahead that standard grep -E may not support, and a shebang-detection loop that runs in a subshell so its flag may not be observable afterwards) which can produce false negatives/positives; these are quality issues rather than malicious behavior.
Install Mechanism
No install spec is provided and the package is instruction-only with a single shell script included. No remote downloads, archives, or package installs occur. Risk from installation is low.
Credentials
The skill requires no environment variables, no credentials, and no config paths. The script does not read or require sensitive system credentials.
Persistence & Privilege
always is false and the skill contains no code to persistently modify agent configuration or enable itself. It runs only when invoked and does not request elevated or persistent privileges.
Scan Findings in Context
[contains-secret-detection-rules] expected: audit.sh intentionally contains grep patterns to detect 'sk-...' API keys, 'password=', 'api_key=', and private key blocks — this is expected for a local audit tool and not a sign of exfiltration.
Assessment
This skill appears to do what it says: a local, read-only audit of a skill directory. Before running: (1) inspect audit.sh yourself (it's short and readable); (2) run it against a copy of the target skill or a non-sensitive test directory to avoid accidentally printing any secrets to your terminal; (3) remember the script only scans files under the provided path — do not point it at system or home directories; (4) be aware of minor bugs that may miss issues or produce false positives, so treat results as advisory and follow up with manual review for any WARN/FAIL output.Like a lobster shell, security has layers — review code before you run it.
latestvk975n3rx63ret41k8mc4de7n6583tk1k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.