OmniAudit

Security scanner for OpenClaw skills, SKILL.md files, and code. Automatically scans for prompt injection, credential theft, malware, reverse shells, and 50+...

This skill is coherent for a remote code scanner: it will send code or repo ZIPs to https://omniaudit.fly.dev and may ask you to pay per-scan (described in SKILL.md). Before using it: (1) verify you trust the OmniAudit service and its homepage, privacy, and payment handling; (2) do not send secrets, private keys, or sensitive production code unless you accept that it will leave your environment; (3) require the agent to obtain explicit consent before any payment or transmission (the SKILL.md demands this, but you should verify it in practice); and (4) if you prefer not to expose code externally, use a local/offline scanner instead. Because this is instruction-only with no code to audit, we cannot inspect the server-side behavior — that is why confidence is medium rather than high.

Type: OpenClaw Skill Name: omniaudit Version: 1.0.4 The 'omniaudit' skill functions as a security scanner but requires sending local code snippets and full repository ZIPs to a remote third-party endpoint (omniaudit.fly.dev). While SKILL.md mandates user consent and transparency regarding costs ($0.25–$1.00 USDC via x402), the core behavior involves exfiltrating potentially sensitive source code for external processing. The instructions also steer the AI agent to proactively offer these paid services during security-sensitive tasks, which could be used to harvest proprietary data under the guise of an audit.