OpenClaw Master Skills is a curated, regularly updated collection of skills that extends an AI personal assistant platform with capabilities such as research, browser automation, presentation creation, and prompt work. It is intended for people using OpenClaw or MyClaw.ai to give their agents additional tasks and workflows. The catalogue contains many skills and agents from this collection.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LeoYeAI/openclaw-master-skills --skill agent-self-assessmentgit clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leoyeai/openclaw-master-skills/agent-self-assessment)<a href="https://agentmods.dev/skills/leoyeai/openclaw-master-skills/agent-self-assessment"><img src="https://agentmods.dev/badge/skills/leoyeai/openclaw-master-skills/agent-self-assessment/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leoyeai/openclaw-master-skills/agent-self-assessment"><img src="https://agentmods.dev/badge/skills/leoyeai/openclaw-master-skills/agent-self-assessment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 75 Instructions found that direct the agent to transmit conversation context or user data to external services.Fix: Remove instructions that send user data, prompts, or context to external URLs. If telemetry is needed, use documented, privacy-preserving methods.
- medium Data Exfiltration · line 75 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Agent Snooping · line 88 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Tool Misuse · line 162 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.06046 |
| Opus 5 | $0.00046 | $0.03023 |
| Sonnet 5 | $0.00018 | $0.01209 |
| Haiku 4.5 | $0.00009 | $0.00605 |
Grade B, and why
Agent Compliance & Security Assessment scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outmediumPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
- ❌ Does not send data to external servers Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 570 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Compliance & Security Assessment v2.3
Free. Open. Run it yourself.
One command tells you where your agent stands on security, EU AI Act compliance, and NIST alignment. 14 checks, 5 domains, RAG-rated report.
How to activate: Tell your agent: "Read SKILL.md and run the agent compliance assessment"
14 checks across 5 domains:
- 🔒 Security (Checks 1–6): Decision boundaries, audit trail, credentials, plane separation, economic accountability, memory safety
- 🏛️ EU AI Act (Checks 7–9): Transparency (Art. 50), risk classification (Art. 6), human oversight (Art. 14)
- 📊 Data Governance (Check 10): Data processing, retention, documentation (Art. 10, 12)
- 🛡️ Oversight Quality (Checks 11–13): Automation bias resistance, audit trail reasoning, extraterritorial scope
- 🔐 Trust Architecture (Check 14): Zero Trust posture for agentic AI (NIST-aligned)
EU AI Act enforcement is underway. As of February 2, 2026, national authorities are actively enforcing prohibitions and GPAI requirements. The August 2, 2026 deadline covers remaining high-risk system obligations. Only 8 of 27 EU member states have designated competent authorities — the compliance gap is real. 4 months remaining.
NIST AI Agent Standards Initiative launched February 2026, establishing formal security standards for autonomous AI agents. This assessment aligns with both EU and US frameworks.
What This Skill Does
This skill instructs the agent to inspect its own configuration and produce an honest compliance report. It reads local files, checks environment structure, and reviews tool and skill setup.
What This Skill Does NOT Do
- ❌ Does not exfiltrate credentials, keys, or secrets
- ❌ Does not send data to external servers
- ❌ Does not modify any files or configuration
- ❌ Does not install software or change system state
- ❌ Does not execute shell commands — all checks are read-only file inspection
- ❌ All checks are passive inspection of the agent's own setup
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 570 lines · 92 tokens per session scan B e7e501a08800
Agent Compliance & Security Assessment is a skill published in the GitHub repository LeoYeAI/openclaw-master-skills (2,139 stars, last pushed 1mo ago), licensed MIT. It adds 92 tokens to every session and 6,046 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
EU AI Act Risk Classification
Decision tree for classifying an AI system into the EU AI Act risk tier (unacceptable/high/limited/minimal) and identifying the actor role (provider/deployer/importer/distributor).
EU AI Act Transparency
Checklist for the Article 50 transparency obligations — chatbot AI disclosure, machine-readable marking of synthetic content, emotion-recognition/biometric-categorisation notice, and deepfake/public-interest-text labelling.
Agent Audit Trail
Append-only, hash-chained audit log for AI agents. Records agent actions, tool calls, decisions, and external writes with provenance, timestamps, and sha256 chain integrity. Designed for compliance with EU AI Act Article 12 automatic event recording requirements for high-risk AI systems.
compliance-scan
Scans a Python AI project for EU AI Act compliance gaps using AIR Blackbox. Use when the user asks to check compliance, scan their code, audit their AI project, or mentions EU AI Act, Articles 9-15, or compliance checking.
interpret-results
Interprets AIR Blackbox scan results and maps findings to specific EU AI Act articles, recitals, and remediation steps. Use when the user has scan output and wants to understand what to fix, why it matters, or how to prioritize.
Compliance Checker
Check regulatory compliance across finance, tax, employment, data privacy, and industry-specific requirements.