← Back to Skills Marketplace
259
Downloads
1
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install skill-security-guide
Description
Security best practices guide for passing ClawHub security scans with "Benign" ratings. Use when creating or reviewing skills to ensure they meet security st...
Usage Guidance
This guide appears coherent and safe to install, but before using or copying examples: (1) never paste real API keys or secrets into SKILL.md or examples, (2) when implementing the checklist, verify your code matches documentation and does not disable SSL or log secrets, (3) run your own static and dynamic checks on code you produce, and (4) be cautious when converting metadata — the recommended single-line JSON format is a documentation requirement, not a mechanism to hide secrets. If you plan to adapt examples into code, test locally and review any added dependencies or env-vars for necessity before publishing.
Capability Analysis
Type: OpenClaw Skill
Name: skill-security-guide
Version: 1.0.1
This skill is a documentation-only security guide designed to help developers create skills that pass security scans. It provides best practices for metadata formatting, SSL verification, and secret handling, and includes benign shell commands (grep) for local verification. There is no executable code or evidence of malicious intent.
Capability Assessment
Purpose & Capability
The skill is a documentation/guide. It declares no binaries, no env vars, and no install steps — which matches the stated purpose of teaching authors how to pass scans.
Instruction Scope
SKILL.md contains developer-facing best-practice checks and examples (grep commands, code snippets). It does not instruct an agent to read arbitrary files, exfiltrate data, contact unexpected endpoints, or access credentials.
Install Mechanism
No install spec and no code files. Being instruction-only minimizes disk writes and execution risk.
Credentials
The skill requests no environment variables or credentials. Example snippets reference env var names only to illustrate best practices and explicitly advise not to print secrets.
Persistence & Privilege
always is false and the skill does not request persistent or elevated privileges or modify other skills' configs. Normal autonomous invocation is allowed but not unusual for an instruction-only skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-security-guide - After installation, invoke the skill by name or use
/skill-security-guide - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Added "Issue 5: Documentation-Code Mismatch (Critical!)" section with real-world example and fixes.
- Included a new "Case Study: Fixing hunyuan-video and hunyuan-3d" detailing how to resolve security issues for actual skills.
- Expanded documentation on aligning response fields, status values, and code to match SKILL.md.
- No changes to metadata or overall structure; this is a documentation expansion for clearer, more actionable security guidance.
v1.0.0
Initial release of skill-security-guide.
- Provides comprehensive security best practices for creating or reviewing skills to pass ClawHub security scans with "Benign" ratings.
- Details correct JSON metadata formatting required in SKILL.md.
- Includes a security checklist covering metadata, code, and documentation requirements.
- Outlines common security issues and fixes, such as SSL verification and information leaks.
- Gives a complete example of a "Benign"-rated skill for reference.
- Explains how this guide complements skill-creator-2, focusing on security while the latter covers skill structure.
Metadata
Frequently Asked Questions
What is Skill Security Guide?
Security best practices guide for passing ClawHub security scans with "Benign" ratings. Use when creating or reviewing skills to ensure they meet security st... It is an AI Agent Skill for Claude Code / OpenClaw, with 259 downloads so far.
How do I install Skill Security Guide?
Run "/install skill-security-guide" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Skill Security Guide free?
Yes, Skill Security Guide is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Skill Security Guide support?
Skill Security Guide is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Skill Security Guide?
It is built and maintained by Tony (@wszhhx); the current version is v1.0.1.
More Skills