Skill Audit

Runs a deterministic static safety audit for third-party AI skill or plugin repositories before install or execution. Use when asked to scan a skill repo, as...

This skill is a static auditor and appears to do what it says: read the target repository, run deterministic pattern-based scans, and optionally call GitHub OSINT. Before running: (1) Understand that the scanner will read all scanned files in the target repo (it does not execute target-repo code), so do not point it at repos that contain private secrets you don't want read. (2) If you enable GitHub OSINT or provide a GITHUB_TOKEN, the tool may make API/network calls; only provide credentials if you trust the tool and want higher rate limits. (3) The code uses git (if available) to get commit SHA—this is optional but expected. (4) If you need absolute assurance, review the run_github_osint_precheck and any network-calling functions before giving network access or a token. Overall the skill is internally consistent and proportionate for a repository safety auditor.

Type: OpenClaw Skill Name: skill-audit-modeio Version: 0.1.0 The skill bundle is a comprehensive static analysis tool designed to perform security audits on third-party AI skills and repositories. It implements a multi-layered scanning engine (in `modeio_skill_audit/skill_safety/`) that detects prompt injection, shell execution risks, secret exfiltration patterns, and supply chain vulnerabilities using deterministic regex-based rules. While the tool performs network requests to the GitHub API for OSINT reputation checks (`repo_intel.py`) and utilizes `subprocess` for Git metadata, these actions are strictly aligned with its documented purpose as a security scanner and do not exhibit signs of malicious intent or unauthorized data exfiltration.