Permission Creep Scanner

Helps detect permission creep in AI agent skills — flags when a skill's actual code accesses resources far beyond what its declared purpose requires, like a...

This skill appears coherent and appropriate for auditing other skills. Before using it, avoid supplying real secrets or credentials as sample input (do not paste .env files or live API keys). If you provide a URL for the skill to fetch, treat that like running an untrusted network resource: only give URLs you trust. If you need higher assurance, run the scanner in an isolated environment or review its output manually rather than letting it autonomously fetch or process data.

Type: OpenClaw Skill Name: permission-creep-scanner Version: 1.0.0 This skill is a 'permission-creep-scanner' designed to detect malicious behavior and over-permissioning in other AI agent skills. The `SKILL.md` file clearly outlines its purpose, the types of security risks it identifies (e.g., sensitive file access, environment variable exfiltration, network calls with API keys, shell access), and provides an example of a malicious skill that it would flag. There is no evidence of malicious intent or prompt injection within the skill's own description or metadata; instead, it serves as a security analysis tool.