Skill Security Audit Pack v1.0

Price: $4.99

Category: security

What it does

Skill Security Audit Pack gives OpenClaw teams a quick static security review for skills and agent bundles before they are shared, installed, or released. It scans for high-risk patterns such as hidden network posts, credential access, unsafe shell execution, obfuscation, missing metadata, and suspicious install behavior, then returns a clear release gate.

It is designed for builders, QA agents, and marketplace operators who need evidence they can keep with their release records without exposing secrets or private paths.

Use cases

Skill marketplace operators who need a repeatable security screen before approving third-party or internally built skills.
Agent teams preparing releases who want JSON evidence for Viper/Warlock-style QA gates and remediation tracking.
Enterprise buyers and auditors who need a plain security summary before allowing agent bundles into governed environments.

Requirements

Python 3.10+.
OpenClaw v2026.3.23 or newer recommended.
No external API keys required.
No network access required; analysis is static and local.
Input: an OpenClaw skill directory containing SKILL.md and related scripts/assets.

Example usage


python scripts/audit_skill_security.py /path/to/skill --fail-on high --output audit.json

Expected output


{
  "tool": "skill-security-audit-pack",
  "skill_dir": "/path/to/skill",
  "files_scanned": 4,
  "totals": {"low": 0, "medium": 0, "high": 0, "critical": 0},
  "findings": [],
  "gate": "PASS"
}

When findings meet or exceed the chosen --fail-on threshold, the command exits with a failing gate and includes file, line, severity, rule, and evidence snippets for remediation.

Marketing copy

Security review for OpenClaw skills in one command: Skill Security Audit Pack scans skill folders for credential harvesting, hidden POSTs, unsafe execution, obfuscation, risky install scripts, binaries, and missing metadata, then produces a clean PASS/FAIL gate with JSON evidence your release team can keep. Built for marketplace operators, QA agents, and enterprise teams that need buyer-ready security confidence before a skill goes live.

Skill Security Audit Pack