Skill Publish Vetter

Pre-publish privacy scan for ClawHub skills. Detects tokens, keys, credentials, .env secrets, personal info, and internal IPs before publishing.

This tool appears to do exactly what it says: it scans a target skill directory for tokens, passwords, private keys, .env values, personal emails/paths, and internal IPs. Before running or using this skill: 1) Confirm the exact target directory you want scanned — the script will read every matched file and can reveal secrets. 2) Be aware SKILL.md requires outputting the full report to chat, which will include detected secret lines (truncated but potentially sensitive); do not run it in a channel or conversation that is public or archived if you do not want those secrets recorded. 3) If you prefer, run bash scripts/publish-check.sh locally in a terminal yourself and inspect the results before copying any parts into chat. 4) Review the actual repository copy of scripts/publish-check.sh (the provided excerpt was truncated in the listing) to ensure no later-added behavior (network calls, uploads, or obfuscation) exists. If you want to proceed, ask the user to explicitly confirm the target path and confirm they understand that the report may contain sensitive data.

Type: OpenClaw Skill Name: skill-publish-vetter Version: 1.1.0 The skill is a defensive utility designed to prevent the accidental publication of secrets (API keys, tokens, passwords) to ClawHub. It implements a mandatory multi-step workflow in SKILL.md that requires a privacy scan and explicit user confirmation before executing the 'clawhub publish' command. The scanning logic in scripts/publish-check.sh uses local grep patterns to identify sensitive data and does not contain any network exfiltration or obfuscated code.