Skill Auditor in Sandbox

Launch a NovitaClaw (OpenClaw) sandbox, install a specified skill, and generate an installation & security audit report. Use when: (1) You want to test a com...

This skill mostly does what it claims, but proceed cautiously. Before installing or running: (1) verify the upstream repository (https://github.com/freecodewu/skill-auditor-in-sandbox) and the novitaclaw install script contents; (2) confirm NOVITA_API_KEY usage and limit its scope if possible; (3) review the two scripts locally — the audit script intentionally obfuscates patterns to avoid static scanners and will capture and include full text of many files (which can leak secrets); (4) run the tool only against untrusted skills inside an isolated Novita sandbox (do not use a production account or high-privilege API key); (5) consider modifying the audit script to avoid exporting sensitive files and to log findings without dumping entire file contents; (6) because the metadata does not declare required env vars, expect to supply SANDBOX_ID and NOVITA_API_KEY manually and verify these prompts before use.

Type: OpenClaw Skill Name: skill-auditor-in-sandbox Version: 1.0.3 The skill-auditor-in-sandbox bundle is a security tool designed to test and audit other OpenClaw skills within an isolated NovitaClaw sandbox. It includes scripts (install-skill.mjs and audit-skill.mjs) that automate the process of launching a sandbox, installing a target skill from GitHub or ClawHub, and scanning for suspicious patterns like shell execution, network calls, and sensitive file access. The code implements input validation for skill names to prevent command injection and uses sandboxing to protect the host environment. While it uses string concatenation for its search patterns (e.g., 'sub' + 'process') to avoid self-detection by static scanners, this is a standard practice for security auditing tools and does not indicate malicious intent.