skills.rest
SafeAgent-Beihang
SafeAgent-BeihangOFFICIAL
Explore all skills by this author →
GitHub

clawguard-auditor

Analyze a target Skill for security risks before installation.

50|4|Updated Mar 15, 2026
Search Tags:#security#sast#auditor#openclaw#skill-audit#intent-drift
One-click install
npx skills add https://github.com/SafeAgent-Beihang/clawguard --skill clawguard-auditor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: clawguard-auditor
Source: https://github.com/SafeAgent-Beihang/clawguard/tree/main/auditor-skill
Command: npx skills add https://github.com/SafeAgent-Beihang/clawguard --skill clawguard-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

ClawGuard Auditor mitigates the risk of installing untrusted Skills by performing comprehensive security analysis before execution, including intent drift detection, SAST, supply chain vetting, and code-block scanning.

Core Features & Use Cases

  • Static Analysis: 100+ SAST rules plus intent drift checks to catch dangerous patterns.
  • Intent Drift Detection: Validates declared capabilities against actual code usage to flag misalignment.
  • Supply Chain Vetting: Dependency CVE checks, typosquatting detection, and provenance scoring for safer installations.
  • SKILL.md Code Scanning: Analyzes code blocks inside documentation to uncover hidden risks.
  • Pre-install Output: Produces a risk verdict and actionable recommendations for safe deployment.
  • Use Case: Evaluate a Skill before installation or during audits of existing repos.

Quick Start

Run the Auditor CLI in the auditor-skill directory to audit a target Skill.

Frequently Asked Questions about clawguard-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Skill for security risks before installing it?▼

To audit a Skill for security risks before installation, perform static analysis, intent drift detection, and supply chain checks across the Skill's code and dependencies to produce a risk verdict.

What is intent drift detection in Skill security scanning?▼

Intent drift detection validates declared capabilities in the SKILL.md frontmatter against actual code usage to flag misalignment. It ensures the Skill's runtime behavior matches its stated description.

How can I check Skill dependencies for typosquatting and CVEs?▼

Check Skill dependencies for typosquatting and CVEs using supply chain vetting. This process scores provenance and inspects declared dependencies to identify vulnerable packages before installation.

Does the security auditor scan code blocks inside SKILL.md documentation?▼

Yes, the security auditor scans code blocks inside SKILL.md documentation. It analyzes these embedded code snippets to uncover hidden risks that might execute during runtime.

What do I need to run a SAST analysis on an untrusted Skill?▼

To run SAST analysis on an untrusted Skill, you need a valid SKILL.md frontmatter with a name and description. The auditor applies 100+ rules to inspect code, dependencies, and runtime behavior.

Can I audit existing Skill repositories or is it only for pre-install checks?▼

You can audit existing Skill repositories or perform pre-install checks. The auditor evaluates target files to produce a structured risk report with actionable recommendations for safe deployment.

Related Skills

Explore More Software Engineering Skills→
lawve-ailawve-ai
630

eu-ai-act-report-oliver-schmidt-prietz

Scan repositories for SKILL.md frontmatter and generate standardized YAML metadata.

Official
Advanced
omni-system-creatoromni-system-creator
16

review-code

Review OMS code changes for security, quality, and maintainability.

Community
Advanced
adityaarsharmaadityaarsharma
2

orbit-sec-supply-chain

Audit Composer and npm dependencies for CVEs, licenses, and typosquatting risks.

Community
Advanced
yangliu2060yangliu2060
39

social-trend-monitor

Monitor Reddit, Instagram, and TikTok trends into a Markdown report.

Community
Basic