skill-auditor

To scan a ClawHub skill for malicious code, use this auditor to run regex pattern matching, base64/hex deobfuscation, and optional LLM intent analysis on the skill's scripts. It generates a clear install safety verdict by detecting high, medium, and low severity risks like remote script execution and credential theft.

Obfuscation detection in code security identifies hidden malicious payloads by decoding base64 and hex encodings within scripts. This process reveals disguised threats such as known indicators of compromise, suspicious domains, and dangerous command patterns like curl|bash or eval() execution before you install a skill.

Yes, the skill-auditor detects social engineering lures and credential theft by scanning for specific keywords, suspicious domains, and access to sensitive system directories. It applies regex pattern matching and optional LLM intent analysis to flag these threats and generate a clear risk verdict.

Yes, you can use gemini for optional LLM intent analysis of suspicious code segments found during the audit. This integrates with the regex pattern matching and deobfuscation layers to evaluate the actual intent of novel malicious code patterns, catching threats that standard matching might miss.

Regex pattern matching alone for malware scans is limited to known indicators of compromise and specific dangerous command patterns like curl|bash. It may miss novel malicious code, which is why this auditor supplements regex with base64/hex deobfuscation and optional LLM intent analysis to evaluate suspicious code segments.