← Back to Skills Marketplace
82
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install skill-auditor-plus
Description
Security, performance, and quality auditing for AgentSkills. Use when reviewing skills before installation, auditing during development, checking installed s...
Usage Guidance
This package appears to be what it says: a local auditing tool implemented as two Python scripts plus documentation. Before installing or running it: (1) inspect the two scripts yourself to confirm they only read files under the target skill directory (they do), (2) run them on non-sensitive test skills first to understand false positives/negatives, (3) be aware the auditors use simple regex heuristics and may miss complex leaks or flag benign patterns, and (4) note the opinionated recommendations (e.g., removing README.md) — adapt thresholds/policies to your environment before applying fixes automatically or in CI.
Capability Analysis
Type: OpenClaw Skill
Name: skill-auditor-plus
Version: 1.0.0
The skill bundle is a legitimate security and performance auditing tool for AgentSkills. It provides Python scripts (security_audit.py and performance_audit.py) that perform static analysis on other skill directories to identify dangerous patterns, hardcoded credentials, and token usage inefficiencies. The code logic is transparent, lacks network exfiltration or unauthorized execution capabilities, and the documentation (SKILL.md and best-practices.md) actively promotes secure development and resource optimization.
Capability Tags
Capability Assessment
Purpose & Capability
Name, description, and included scripts (security_audit.py, performance_audit.py) align with an auditing tool. The skill does not request unrelated credentials, binaries, or system paths that would be out of scope for an auditor. One minor design choice: the performance auditor flags common files like README.md as 'unnecessary', which is an opinionated policy rather than a security mismatch.
Instruction Scope
SKILL.md instructs running the two bundled Python auditors against skill directories and integrating them into CI. The runtime instructions do not attempt to read system secrets or contact external endpoints. Note: the auditors use regex heuristics (and try to skip matches inside comments/code blocks) which may produce false negatives/positives; also the performance auditor's 'remove README.md' recommendation is aggressive and may be undesirable for some projects.
Install Mechanism
No install spec is provided (instruction-only plus bundled scripts). That is the lowest-risk install model: nothing is downloaded or written during install. The skill includes local Python scripts which run locally when invoked.
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. The scripts scan files for hardcoded credentials but do not request or require external secrets or cloud credentials to function.
Persistence & Privilege
always is false and the skill does not request persistent system presence or modify other skills. It does not attempt to enable itself or write agent-wide configurations.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install skill-auditor-plus - After installation, invoke the skill by name or use
/skill-auditor-plus - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of Skill Auditor Plus, an automated auditing tool for AgentSkills.
- Provides automated security, performance, and quality audits for AgentSkills.
- Scans for dangerous operations, credential leaks, token bloat, and best practices violations.
- Offers severity levels for security issues and actionable advice in audit reports.
- Includes scripts for running audits before installation, during development, or in batch for installed skills.
- Supplies performance metrics (token counts, line counts) and recommendations for optimization.
- Offers guidelines for customization, troubleshooting, and integration with CI/CD pipelines.
- Ships with comprehensive documentation and best practices references.
Metadata
Frequently Asked Questions
What is skill-auditor-plus?
Security, performance, and quality auditing for AgentSkills. Use when reviewing skills before installation, auditing during development, checking installed s... It is an AI Agent Skill for Claude Code / OpenClaw, with 82 downloads so far.
How do I install skill-auditor-plus?
Run "/install skill-auditor-plus" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is skill-auditor-plus free?
Yes, skill-auditor-plus is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does skill-auditor-plus support?
skill-auditor-plus is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created skill-auditor-plus?
It is built and maintained by caleb (@caleb-niu007); the current version is v1.0.0.
More Skills