Minimal helper to audit skill.md-style instructions for supply-chain risks.

This skill appears coherent and low-risk: it's a local Python script that heuristically scans a single skill.md for suspicious patterns. Before using it, quickly eyeball audit.py yourself (it's short and included), and be aware it only searches text with simple regexes (it can miss obfuscated strings, multi-file issues, or nested downloads). Don't rely solely on its output — treat it as a first-pass aid and perform manual review for anything flagged. If you plan to scan skill files containing secrets, run the tool on a sanitized copy or in a sandboxed environment.

Type: OpenClaw Skill Name: agents-skill-security-audit Version: 0.1.0 This skill bundle is designed to audit other OpenClaw skill bundles for supply-chain risks. The `audit.py` script scans input files for patterns indicative of data exfiltration (e.g., `http://`, `webhook`, `ngrok`), sensitive file access (e.g., `.env`, `.ssh`, `credentials`), and dangerous shell commands (e.g., `curl | bash`, `sudo`, `rm -rf`). The script itself only reads files and performs regex matching; it does not execute any external commands, make network calls, or modify files. The `SKILL.md` and `README.md` files provide clear, benign instructions for using the auditing tool. There is no evidence of malicious intent, prompt injection, or high-risk behaviors within this skill bundle itself.