Skill Auditor

Security scanner that catches malicious skills before they steal your data. Detects credential theft, prompt injection, and hidden backdoors. Works immediately with zero setup. Optional AST dataflow analysis traces how your data moves through code.

This package appears internally consistent with its stated role as a local security scanner. Before running it: 1) Inspect scripts/setup.js and scripts/scan-skill.js (they are present) to confirm the setup wizard does not run unexpected network commands or install remote code automatically. 2) Run the tool in an isolated environment (VM/temporary container) first, especially before enabling auto-scan. 3) If you plan to use VirusTotal or the LLM features, provide those API keys only if you trust the repository; agree to their privacy implications. 4) Verify the repository/origin (the package.json repo points to a GitHub URL) and check commit history or upstream project to increase confidence. 5) If you want higher assurance, ask the publisher for a signed release or checksum; absence of a homepage / known publisher keeps overall confidence at medium.

Type: OpenClaw Skill Name: skill-auditor Version: 2.1.3 The OpenClaw AgentSkills skill bundle 'skill-auditor' is a security scanner designed to detect malicious behavior in other skills. Its code and documentation consistently align with this stated purpose. All seemingly 'risky' capabilities, such as file system access, network requests, shell execution, and LLM interaction, are implemented to analyze and audit other skills, not to perform malicious actions against the user or the OpenClaw agent. For example, `scripts/analyzers/static.js` defines extensive regex patterns to detect prompt injection, data exfiltration, and persistence mechanisms, but these patterns are used for detection, not execution by the auditor itself. The setup script creates benign shell hooks to automate scanning of newly installed skills, providing user control over warnings. There is no evidence of intentional harmful behavior by this skill.