Skill Safety Auditor

Perform comprehensive security audits on skills to identify vulnerabilities, unsafe patterns, and compliance issues. Use when auditing skills for security, c...

This skill performs static audits and that matches its description, but treat the packaged scripts as code you must inspect before executing. Recommended steps before installing or running: 1) Open scripts/audit-skill.sh, quick-scan.sh, and test.sh and search for any hardcoded credentials or outbound network calls; remove any secrets found. 2) Because list-audits.sh uses jq but the skill doesn't declare jq as required, ensure jq is available or modify the script to handle its absence. 3) Run the scripts in an isolated/sandbox environment (or container) pointed at a non-sensitive test directory first — the scanner reads arbitrary files and will write JSON reports into the skill's data directory. 4) Consider removing or cleaning the included data/AUDIT-*.json files (they appear to contain findings that reference secrets in the package). 5) If you plan to allow autonomous agent invocation, only do so after cleaning the package; otherwise restrict invocation until you vet the code. If you want, I can highlight the exact lines in the scripts that look suspicious or walk through how to run them safely in a container.

Type: OpenClaw Skill Name: skill-safety-auditor Version: 1.0.0 The skill-safety-auditor is a legitimate security tool designed to perform static analysis on other skills using shell scripts (audit-skill.sh, quick-scan.sh). It uses grep-based pattern matching to identify potential secrets, injection vulnerabilities, and insecure network configurations, storing results locally in a data directory without any evidence of data exfiltration or malicious intent.