skill-auditor

To check for prompt injection and security vulnerabilities, audit the skill's SKILL.md file using a structured six-step protocol that identifies data exfiltration patterns and yields severity-based verdicts.

Typosquatting is a supply chain attack where malicious skills mimic legitimate names to deceive users. You can prevent installing malicious skills by running a pre-install security vetting process that analyzes the skill file for deceptive naming patterns.

You audit OpenClaw skills for excessive permissions and supply chain risks by analyzing the skill's metadata against a structured review protocol, which generates a safe-run plan and a specific security verdict.

When auditing skills for data exfiltration patterns, the security review provides four severity-based verdicts: SAFE, SUSPICIOUS, DANGEROUS, or BLOCK, accompanied by specific findings and recommendations to prevent unsafe installations.

Yes, you can vet unknown OpenClaw skills using a six-step audit protocol that analyzes typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns before integration into your environment.