skill-auditor

A skill security audit checks OpenClaw skills for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns before installation. It analyzes metadata and dependencies to identify potential security threats.

To vet an OpenClaw skill, provide the auditor with the skill URL. It follows a fixed six-step protocol to analyze permissions, dependencies, and prompt injection vulnerabilities, generating a detailed audit report with severity-based verdicts and recommendations.

Yes, you can check for prompt injection and data exfiltration risks. The auditor scans the skill's code and metadata for these specific vulnerability patterns, flagging them in the final audit report with corresponding severity levels.

Yes, the audit report includes a recommended safe-run plan. Alongside severity-based verdicts on identified red flags like over-privileged permissions, it provides actionable recommendations for safely running the vetted skill.

The best way to prevent malicious OpenClaw skills from entering your workspace is performing a structured pre-install security review. Auditing metadata, permissions, and supply chain dependencies stops over-privileged or malicious skills before installation.