skill-security-audit

Scan installed Claude Code and OpenClaw skills for malicious patterns.

9|2|Updated Feb 9, 2026

Search Tags:#security #python #audit #ioc #ai-skills #clawhub

Ready to run

npx skills add https://github.com/smartchainark/skill-security-audit --skill skill-security-audit-smartchainark

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-security-audit
Source: https://github.com/smartchainark/skill-security-audit/tree/main
Command: npx skills add https://github.com/smartchainark/skill-security-audit --skill skill-security-audit-smartchainark

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The Skill Security Audit detects malicious patterns in AI Agent skills to prevent backdoors, credential theft, data exfiltration, and supply-chain attacks.

Core Features & Use Cases

13 detectors covering the full attack surface, including two-stage payloads, credential theft, and persistence
Zero-dependency Python scanner with IOC database
Auto-discovers installed Claude/OpenClaw skills and reports findings

Quick Start

Run the scanner to audit all installed skills.

Frequently Asked Questions about skill-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan installed AI Agent skills for backdoors and credential theft?▼

To scan installed AI Agent skills for backdoors and credential theft, run the zero-dependency Python scanner to auto-discover and audit skill directories using 13 detectors and an IOC-backed database to surface high-confidence findings.

What types of malicious patterns can a security audit detect in AI skills?▼

A security audit detects malicious patterns in AI skills using 13 detectors covering the full attack surface, including two-stage payloads, credential theft, persistence mechanisms, data exfiltration, and supply-chain attack indicators.

Do I need to install Python dependencies to audit my Claude Code skills?▼

No, you do not need to install Python dependencies to audit Claude Code skills. The scanner is a zero-dependency Python script that automatically discovers and scans installed skill directories without external packages.

Can I use this scanner to check OpenClaw skill directories for data exfiltration?▼

Yes, you can use this scanner to check OpenClaw skill directories for data exfiltration. It applies to both Claude Code and OpenClaw skill directories, auto-discovering installed skills to report high-confidence findings.

What is the best way to prevent supply-chain attacks on AI Agent skills?▼

The best way to prevent supply-chain attacks on AI Agent skills is automating safety scans with an IOC-backed database. This identifies malicious patterns, backdoors, and credential theft before deployed skill directories are executed.