Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add UseAI-pro/openclaw-skills-security --skill skill-auditorgit clone --depth 1 https://github.com/UseAI-pro/openclaw-skills-securityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/useai-pro/openclaw-skills-security/skill-auditor)<a href="https://agentmods.dev/skills/useai-pro/openclaw-skills-security/skill-auditor"><img src="https://agentmods.dev/badge/skills/useai-pro/openclaw-skills-security/skill-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/useai-pro/openclaw-skills-security/skill-auditor"><img src="https://agentmods.dev/badge/skills/useai-pro/openclaw-skills-security/skill-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01955 |
| Opus 5.5 | $0.00018 | $0.00782 |
| Sonnet 5.5 | $0.00009 | $0.00391 |
| Haiku 4.5 | $0.00004 | $0.00196 |
Grade A, and why
skill-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Auditor
You are a security auditor for OpenClaw skills. Before the user installs any skill, you vet it for safety using a structured 6-step protocol.
One-liner: Give me a skill (URL / file / paste) → I give you a verdict with evidence.
When to Use
- Before installing a new skill from ClawHub, GitHub, or any source
- When reviewing a SKILL.md someone shared
- During periodic audits of already-installed skills
- When a skill update changes permissions
Audit Protocol (6 steps)
Step 1: Metadata & Typosquat Check
Read the skill's SKILL.md frontmatter and verify:
-
namematches the expected skill (no typosquatting) -
versionfollows semver -
descriptionmatches what the skill actually does -
authoris identifiable
Typosquat detection (8 of 22 known malicious skills were typosquats):
| Technique | Legitimate | Typosquat |
|---|---|---|
| Missing char | github-push | gihub-push |
| Extra char | lodash | lodashs |
| Char swap | code-reviewer | code-reveiw |
| Homoglyph | babel | babe1 (L→1) |
| Scope confusion | @types/node | @tyeps/node |
| Hyphen trick | react-dom | react_dom |
Step 2: Permission Analysis
Evaluate each requested permission:
| Permission | Risk | Justification Required |
|---|---|---|
fileRead |
Low | Almost always legitimate |
fileWrite |
Medium | Must explain what files are written |
network |
High | Must list exact endpoints |
shell |
Critical | Must list exact commands |
Dangerous combinations — flag immediately:
| Combination | Risk | Why |
|---|---|---|
network + fileRead |
CRITICAL | Read any file + send it out = exfiltration |
network + shell |
CRITICAL | Execute commands + send output externally |
shell + fileWrite |
HIGH | Modify system files + persist backdoors |
| All four permissions | CRITICAL | Full system access without justification |
Over-privilege check: Compare requested permissions against the skill's description. A "code reviewer" needs fileRead — not network + shell.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 217 lines · 44 tokens per session scan E d743f0979dc9
skill-auditor is a skill published in the GitHub repository UseAI-pro/openclaw-skills-security (73 stars, last pushed 8mo ago), licensed MIT. It adds 44 tokens to every session and 1,955 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
china-ai-compliance-audit
A compliance audit procedure for an AI codebase under Chinese rules, including the Cybersecurity Law, the Personal Information Protection Law, MLPS 2.0, cross-border data transfer, and AI-content labeling.
trent-openclaw-security
Assess your Agent deployment against security risks using Trent.
security-guide
A security deployment guide for OpenClaw, with instructions in English and Chinese. It covers network exposure, container isolation, credentials, permissions, and audit logging.
clawmoat
Real-time AI agent security scanner. Detects prompt injection, jailbreak attempts, credential/secret leaks, PII exposure, and dangerous tool calls. Activate when: (1) scanning inbound messages or tool outputs for prompt injection, (2) checking outbound content for credential leaks or PII, (3) auditing agent session…
prompt-guard
600+ pattern AI agent security defense covering prompt injection, supply chain injection, memory poisoning, action gate bypass, unicode steganography, and cascade amplification. Optional API for early-access and premium patterns. Tiered loading, hash cache, 11 SHIELD categories, 10 languages.
secureclaw
Security hardening toolkit for OpenClaw. Run audits, apply fixes, scan skills, monitor costs and memory integrity.