Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jd-opensource/joysafeter/skill-security-auditornpx skills add jd-opensource/JoySafeter --skill skill-security-auditorgit clone --depth 1 https://github.com/jd-opensource/JoySafeterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jd-opensource/joysafeter/skill-security-auditor)<a href="https://agentmods.dev/skills/jd-opensource/joysafeter/skill-security-auditor"><img src="https://agentmods.dev/badge/skills/jd-opensource/joysafeter/skill-security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.02433 |
| Opus 5 | $0.00020 | $0.01216 |
| Sonnet 5 | $0.00008 | $0.00487 |
| Haiku 4.5 | $0.00004 | $0.00243 |
Grade B, and why
skill-security-auditor scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
| 角色劫持 | CRITICAL | "You are now a...", "Ignore previous instructions" | Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 下载执行 | `curl\|wget.*\| bash`, `python -c "$(curl..."` | CRITICAL | Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| Python | `exec()`, `eval()`, `subprocess`, `os.system`, `socket` | HIGH | How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Security Auditor
基于《OpenClaw 极简安全实践指南》和《安全验证与攻防演练手册》的 Skill 安全审计工具。对 OpenClaw Skill 进行从源码到运行时的全生命周期安全审查，覆盖供应链投毒、Prompt 注入载荷、恶意代码模式、权限越权等威胁向量。
Purpose
OpenClaw Skills 是 Agent 能力的扩展机制，通过 /workspace/skills/{skill_name}/SKILL.md 被 Agent 加载执行。恶意 Skill 可以：
- 通过 Prompt 注入劫持 Agent 行为
- 在代码块中嵌入反弹 Shell、数据外传命令
- 引用恶意外部依赖进行供应链攻击
- 通过 Unicode 混淆、零宽字符隐藏恶意指令
本技能为 Skill 的安装和更新提供安全门禁，在 Skill 进入生产环境前完成安全审查。
Prerequisites
输入要求
- 目标 Skill 目录路径（包含
SKILL.md和references/等） - 或 Skill 的远程仓库 URL（用于拉取审计）
环境要求
- Node.js 运行时（用于执行审计脚本）
- 对 Skill 文件的读取权限
Core Workflow
- 元数据验证: 解析 SKILL.md 的 frontmatter，验证 name、version、description、metadata 完整性和合法性。
- Prompt 注入扫描: 检测 SKILL.md 正文中的指令注入模式（角色劫持、指令覆盖、隐蔽指令）。
- 代码块安全审计: 提取所有代码块（bash, python, javascript 等），对每个代码块进行恶意模式检测。
- 依赖与引用审查: 检查 Skill 引用的外部 URL、npm 包、Python 包的安全性和来源可信度。
- 文件结构检查: 验证 Skill 目录结构是否符合规范，检测异常文件（二进制、可执行文件、符号链接）。
- Unicode 和编码检测: 扫描隐藏的 Unicode 控制字符、零宽字符、Bidi 覆盖字符。
- 权限声明审查: 验证 Skill 声明的权限范围是否合理，检测权限越权请求。
- 历史版本对比: 对 Skill 更新进行 diff 分析，检测是否引入了新的恶意内容。
- 沙箱验证: 在受限环境中试运行 Skill 代码片段，观察其行为。
审计检查项
1. 元数据完整性
| 检查项 | 风险等级 | 检测规则 |
|---|---|---|
| frontmatter 缺失 | HIGH | SKILL.md 无 YAML frontmatter |
| name 与目录名不匹配 | MEDIUM | name 字段与所在目录名不一致 |
| version 格式无效 | LOW | 非 semver 格式 |
| description 为空 | MEDIUM | 缺少描述，难以审查意图 |
| category 未声明 | LOW | metadata 中缺少 category |
| risk 标记为 unsafe | HIGH | 自声明高风险 |
| requires 声明可疑二进制 | HIGH | 依赖 nc, ncat, socat 等 |
2. Prompt 注入检测
| 检测模式 | 风险等级 | 示例 |
|---|---|---|
| 角色劫持 | CRITICAL | "You are now a...", "Ignore previous instructions" |
| 指令覆盖 | CRITICAL | "Do not follow any rules", "Override system prompt" |
| 隐蔽指令 | HIGH | HTML 注释中的指令, CSS display:none 包裹的文本 |
| 输出操控 | HIGH | "Always respond with...", "Never mention..." |
| 权限升级 | CRITICAL | "Execute with admin privileges", "Disable safety checks" |
| 零宽字符隐藏 | CRITICAL | \u200B, \u200C, \u200D, \uFEFF 隐藏的指令 |
| Bidi 覆盖攻击 | CRITICAL | \u202A-\u202E 改变文本显示方向 |
| Markdown 注入 | MEDIUM | 通过 Markdown 渲染差异隐藏内容 |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 204 lines · 40 tokens per session scan B acc68bb3e9eb
skill-security-auditor is a skill published in the GitHub repository jd-opensource/JoySafeter (306 stars, last pushed today), licensed Apache-2.0. It adds 40 tokens to every session and 2,433 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 3 findings (instruction-override phrasing, makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-authoring
Author SKILL.md skills: frontmatter, validator limits, structure.
swarmclaw
AI agent runtime and multi-agent orchestration platform. Teaches agents how to use SwarmClaw's 6 primitive tools, persistent memory, dreaming, delegation, connectors, credentials, and the skill system. Use when an agent is running on SwarmClaw and needs to understand the platform's capabilities.
nemoclaw-maintainer-find-review-pr
Find open PRs with the security label and Urgent or High Project Priority. Link each PR to its issue. Identify competing or superseded PRs and report review candidates. Use when looking for the next PR to review. Trigger keywords - find pr, find review, next pr, pr to review, duplicate pr, security pr.
nemoclaw-maintainer-verify-stale
Verifies whether stale NVIDIA/NemoClaw bug reports still reproduce on the newest release tag. Use when maintainers ask to verify stale issues, reproduce old bugs on the newest release tag, or drain the bug backlog. Treats issue reproducers as untrusted, validates them on the reported release before a fixed verdict…
nemoclaw-maintainer-triage
Triage NemoClaw issues and PRs with Issue Type, Project fields, and allowed labels. Support one item or a batch. Show proposed changes and apply only changes the maintainer accepts. Trigger keywords - triage, label issues, suggest labels, batch triage, triage issue, triage PR, label this, what labels.
nemoclaw-maintainer-cross-issue-sweep
Scan open issues to find issues that a PR can also fix or conflict with. Report each relationship with file and line evidence. Use this skill during PR review to find related fixes and risks.