{
  "markdown": "# openclaw-skills-security\n\nSecurity-first skills for the **OpenClaw** ecosystem — maintained by **UseClawPro** (UseAI.pro).\n\nTwo auditor skills for end-users, plus 11 reusable modules (advanced checks).\n\n| Job | Skill | What it does |\n|-----|-------|-------------|\n| **Audit a skill** | `skill-auditor` | Vet any SKILL.md before install (typosquatting, permissions, prompt injection, supply chain, exfiltration) |\n| **Audit your setup** | `setup-auditor` | Check your environment for credential leaks, unsafe defaults, missing sandbox (wizard-style) |\n\nThese are **instruction modules** (`SKILL.md`) — they don't run on their own. Load them into a host agent (Codex CLI / Claude Code / OpenClaw) or paste into any LLM chat.\n\nQuick links:\n- UseClawPro security hub: https://useclaw.pro/\n- Pillar guide: https://useclaw.pro/guides/openclaw-security/\n- Skill Verifier (browser): https://useclaw.pro/verifier/\n- Verified Skills (catalog): https://useclaw.pro/verified-skills/\n\n## Quickstart\n\n### Job 1 — Audit a skill before installing\n\n**Fast (browser):** paste the skill URL/name into [UseClawPro Verifier](https://useclaw.pro/verifier/).\n\n**Deep (agent):** load `skill-auditor` and give it the target:\n\n```\n1) Paste skills/skill-auditor/SKILL.md into your agent\n2) Paste the target skill's SKILL.md\n3) Ask: \"Audit this skill. Return a SKILL AUDIT REPORT.\"\n```\n\nThe auditor runs a 6-step protocol: metadata & typosquat check → permission analysis → dependency audit → prompt injection scan → network & exfiltration analysis → content red flags.\n\nVerdict: **SAFE / SUSPICIOUS / DANGEROUS / BLOCK**.\n\n### Job 2 — Audit your environment\n\nLoad `setup-auditor` and answer 5 wizard questions about your workspace:\n\n```\n1) Paste skills/setup-auditor/SKILL.md into your agent\n2) Answer the wizard: workspace path, host agent, permissions, sandbox, ports\n3) Get a SETUP AUDIT REPORT with a fix checklist\n```\n\nThe auditor runs a 4-step protocol: credential scan → config audit → sandbox readiness → persistence check.\n\nVerdict: **READY / RISKY / NOT_READY**.\n\n### Install into your host agent\n\n- **Codex CLI (global):** `ln -s \"$PWD/skills/skill-auditor\" ~/.codex/skills/skill-auditor` and `ln -s \"$PWD/skills/setup-auditor\" ~/.codex/skills/setup-auditor`\n- **Claude Code (project):** `ln -s \"$PWD/skills/skill-auditor\" .claude/skills/skill-auditor` and `ln -s \"$PWD/skills/setup-auditor\" .claude/skills/setup-auditor`\n- **No tooling:** just paste the SKILL.md content into your LLM chat.\n\nModules are optional: you usually don't need to install them separately.\n\n## Metadata contract\n\nThis repo keeps Codex/OpenClaw-compatible frontmatter intentionally small at the top level:\n\n- `name`\n- `description`\n- `metadata.*`\n\nGeneral skill metadata lives under `metadata.*`, while audit-specific classification lives under `metadata.audit.*`.\nThis keeps the frontmatter compatible with Codex-style loaders while still giving us enough structure for catalog export and review.\n\nExample:\n\n```yaml\n---\nname: setup-auditor\ndescription: Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration.\nmetadata:\n  short-description: Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.\n  why: Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.\n  what: Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence checks.\n  how: Collects operator answers, runs a four-step review, and turns findings into a fix checklist.\n  results: Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.\n  version: 2.0.0\n  updated: '2026-03-10T00:00:00Z'\n  jtbd-1: When I need to know whether my current OpenClaw environment is safe enough to run skills at all.\n  audit:\n    kind: auditor\n    author: useclawpro\n    category: Security\n    trust-score: 96\n    last-audited: '2026-02-05'\n    permissions:\n      file-read: true\n      file-write: true\n      network: false\n      shell: false\n---\n```\n\n## Threat coverage\n\nBoth auditors together cover **12/12 real-world attack types** observed in the wild (including the ClawHavoc campaign):\n\n| # | Attack type | skill-auditor | setup-auditor |\n|---|------------|:---:|:---:|\n| T1 | Typosquatting | **primary** | |\n| T2 | Credential theft | | **primary** |\n| T3 | Crypto miners | | **primary** |\n| T4 | Reverse shells | **primary** | yes |\n| T5 | Prompt injection | **primary** | |\n| T6 | Skill loader exploits | **primary** | yes |\n| T7 | Obfuscated commands | yes | |\n| T8 | Supply chain attack | **primary** | |\n| T9 | Social engineering | yes | |\n| T10 | Persistence | | **primary** |\n| T11 | Over-privilege | **primary** | yes |\n| T12 | Data exfiltration | **primary** | yes |\n\nFull evidence: [docs/threat-coverage-matrix.md](docs/threat-coverage-matrix.md)\n\n## Flow\n\n```mermaid\nflowchart TD\n  A[Find a skill] --> B{Audit before install}\n  B -->|Fast| C[UseClawPro Verifier]\n  B -->|Deep| D[skill-auditor]\n  C --> E{Verdict}\n  D --> E\n  E -->|SAFE| F[Install into host agent]\n  E -->|DANGER| G[Do not install — report it]\n  F --> H[Run in sandbox, no network]\n  H -->|Suspect compromise?| I[Incident Response Playbook]\n\n  J[New environment] --> K[setup-auditor]\n  K --> L{Verdict}\n  L -->|READY| M[Safe to run skills]\n  L -->|NOT_READY| N[Fix checklist → re-run]\n```\n\n## What's inside\n\n```\nskills/\n  skill-auditor/SKILL.md    — Job 1: vet any skill (6-step protocol)\n  setup-auditor/SKILL.md    — Job 2: audit your environment (wizard + 4-step)\n  config-hardener/SKILL.md  — module: harden OpenClaw config\n  credential-scanner/SKILL.md — module: scan workspace for leaked secrets\n  dependency-auditor/SKILL.md — module: supply chain / install hooks\n  incident-responder/SKILL.md — module: post-incident playbook (contain → rotate → recover)\n  network-watcher/SKILL.md  — module: network/exfil checks\n  output-sanitizer/SKILL.md — module: redact secrets/PII from agent output\n  permission-auditor/SKILL.md — module: permission fit + dangerous combos\n  prompt-guard/SKILL.md     — module: prompt injection detection\n  sandbox-guard/SKILL.md    — module: Docker sandbox profiles\n  skill-guard/SKILL.md      — module: runtime monitoring checklist\n  skill-vetter/SKILL.md     — module: legacy “deep audit” checklist\n\ndocs/\n  threat-coverage-matrix.md — evidence: which checks catch which attacks\n  config-hardening-checklist.md — minimum security baseline\n  incident-response-playbook.md — what to do if compromised\n```\n\n## What it checks (and what it doesn't)\n\n**skill-auditor** checks:\n- Typosquatting & naming anomalies\n- Permission combinations (`network` + `shell` = critical)\n- Dependency supply chain (install hooks, obfuscation, recent publish)\n- Prompt injection patterns (role hijacking, hidden instructions)\n- Network exfiltration (suspicious endpoints, DNS tunneling, data in headers)\n- Content red flags (credential paths, encoded commands, sudo)\n\n**setup-auditor** checks:\n- Exposed secrets in workspace (`.env`, keys, tokens — with regex patterns)\n- Config hardening (AGENTS.md, permission defaults, gateway)\n- Sandbox readiness (Docker, resource limits, isolation)\n- Persistence indicators (`.bashrc`, `authorized_keys`, cron, git hooks)\n\n**Neither** guarantees:\n- Runtime behavior analysis (static check only)\n- Zero-day logic hidden in dependencies\n- Full supply chain provenance\n\nTreat untrusted skills as **code execution**. Default to sandboxing.\n\n## Skills catalog\n\n<!-- catalog:start -->\n\n| Skill | Type | Category | Trust | Perms | Last audited | Version |\n| --- | --- | --- | ---: | --- | --- | --- |\n| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 | 2.0.0 |\n| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 | 2.0.0 |\n| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 | 1.0.0 |\n| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 | 1.0.0 |\n| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 | 1.0.0 |\n| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 | 1.0.0 |\n| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 | 1.0.0 |\n| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 | 1.0.0 |\n| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |\n| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 | 1.0.0 |\n| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |\n| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 | 1.0.0 |\n| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 | 1.0.0 |\n\n<!-- catalog:end -->\n\n## Report a malicious skill\n\nIf you find a suspicious OpenClaw skill in the wild, please open an issue (sanitized evidence, no secrets):\n\n- https://github.com/UseAI-pro/openclaw-skills-security/issues/new?template=report-malicious-skill.md\n\n## Contributing\n\nSee `CONTRIBUTING.md`.\n",
  "bytes": 9339,
  "sha": "2008e33f7d14570efe03c1e8fbc948a7613c6dbf2966da951273d19c71fa8025",
  "repo_slug": "useai-pro/openclaw-skills-security",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_useai_pro_openclaw_skills_security_skill_92c75acc/readme"
}