openclaw-skills-security

Security-first skills for the OpenClaw ecosystem — maintained by UseClawPro (UseAI.pro).

Two auditor skills for end-users, plus 11 reusable modules (advanced checks).

These are instruction modules (SKILL.md) — they don't run on their own. Load them into a host agent (Codex CLI / Claude Code / OpenClaw) or paste into any LLM chat.

Quick links:

• UseClawPro security hub: https://useclaw.pro/
• Pillar guide: https://useclaw.pro/guides/openclaw-security/
• Skill Verifier (browser): https://useclaw.pro/verifier/
• Verified Skills (catalog): https://useclaw.pro/verified-skills/

Quickstart

Job 1 — Audit a skill before installing

Fast (browser): paste the skill URL/name into UseClawPro Verifier.

Deep (agent): load skill-auditor and give it the target:

1) Paste skills/skill-auditor/SKILL.md into your agent
2) Paste the target skill's SKILL.md
3) Ask: "Audit this skill. Return a SKILL AUDIT REPORT."

The auditor runs a 6-step protocol: metadata & typosquat check → permission analysis → dependency audit → prompt injection scan → network & exfiltration analysis → content red flags.

Verdict: SAFE / SUSPICIOUS / DANGEROUS / BLOCK.

Job 2 — Audit your environment

Load setup-auditor and answer 5 wizard questions about your workspace:

1) Paste skills/setup-auditor/SKILL.md into your agent
2) Answer the wizard: workspace path, host agent, permissions, sandbox, ports
3) Get a SETUP AUDIT REPORT with a fix checklist

The auditor runs a 4-step protocol: credential scan → config audit → sandbox readiness → persistence check.

Verdict: READY / RISKY / NOT_READY.

Install into your host agent

• Codex CLI (global): ln -s "$PWD/skills/skill-auditor" ~/.codex/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" ~/.codex/skills/setup-auditor
• Claude Code (project): ln -s "$PWD/skills/skill-auditor" .claude/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" .claude/skills/setup-auditor
• No tooling: just paste the SKILL.md content into your LLM chat.

Modules are optional: you usually don't need to install them separately.

Metadata contract

This repo keeps Codex/OpenClaw-compatible frontmatter intentionally small at the top level:

• name
• description
• metadata.*

General skill metadata lives under metadata.*, while audit-specific classification lives under metadata.audit.*. This keeps the frontmatter compatible with Codex-style loaders while still giving us enough structure for catalog export and review.

Example:

---
name: setup-auditor
description: Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration.
metadata:
  short-description: Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.
  why: Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.
  what: Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence checks.
  how: Collects operator answers, runs a four-step review, and turns findings into a fix checklist.
  results: Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.
  version: 2.0.0
  updated: '2026-03-10T00:00:00Z'
  jtbd-1: When I need to know whether my current OpenClaw environment is safe enough to run skills at all.
  audit:
    kind: auditor
    author: useclawpro
    category: Security
    trust-score: 96
    last-audited: '2026-02-05'
    permissions:
      file-read: true
      file-write: true
      network: false
      shell: false
---

Threat coverage

Both auditors together cover 12/12 real-world attack types observed in the wild (including the ClawHavoc campaign):

Full evidence: docs/threat-coverage-matrix.md

Flow

flowchart TD
  A[Find a skill] --> B{Audit before install}
  B -->|Fast| C[UseClawPro Verifier]
  B -->|Deep| D[skill-auditor]
  C --> E{Verdict}
  D --> E
  E -->|SAFE| F[Install into host agent]
  E -->|DANGER| G[Do not install — report it]
  F --> H[Run in sandbox, no network]
  H -->|Suspect compromise?| I[Incident Response Playbook]

  J[New environment] --> K[setup-auditor]
  K --> L{Verdict}
  L -->|READY| M[Safe to run skills]
  L -->|NOT_READY| N[Fix checklist → re-run]

What's inside

skills/
  skill-auditor/SKILL.md    — Job 1: vet any skill (6-step protocol)
  setup-auditor/SKILL.md    — Job 2: audit your environment (wizard + 4-step)
  config-hardener/SKILL.md  — module: harden OpenClaw config
  credential-scanner/SKILL.md — module: scan workspace for leaked secrets
  dependency-auditor/SKILL.md — module: supply chain / install hooks
  incident-responder/SKILL.md — module: post-incident playbook (contain → rotate → recover)
  network-watcher/SKILL.md  — module: network/exfil checks
  output-sanitizer/SKILL.md — module: redact secrets/PII from agent output
  permission-auditor/SKILL.md — module: permission fit + dangerous combos
  prompt-guard/SKILL.md     — module: prompt injection detection
  sandbox-guard/SKILL.md    — module: Docker sandbox profiles
  skill-guard/SKILL.md      — module: runtime monitoring checklist
  skill-vetter/SKILL.md     — module: legacy “deep audit” checklist

docs/
  threat-coverage-matrix.md — evidence: which checks catch which attacks
  config-hardening-checklist.md — minimum security baseline
  incident-response-playbook.md — what to do if compromised

What it checks (and what it doesn't)

skill-auditor checks:

• Typosquatting & naming anomalies
• Permission combinations (network + shell = critical)
• Dependency supply chain (install hooks, obfuscation, recent publish)
• Prompt injection patterns (role hijacking, hidden instructions)
• Network exfiltration (suspicious endpoints, DNS tunneling, data in headers)
• Content red flags (credential paths, encoded commands, sudo)

setup-auditor checks:

• Exposed secrets in workspace (.env, keys, tokens — with regex patterns)
• Config hardening (AGENTS.md, permission defaults, gateway)
• Sandbox readiness (Docker, resource limits, isolation)
• Persistence indicators (.bashrc, authorized_keys, cron, git hooks)

Neither guarantees:

• Runtime behavior analysis (static check only)
• Zero-day logic hidden in dependencies
• Full supply chain provenance

Treat untrusted skills as code execution. Default to sandboxing.

Skills catalog

Report a malicious skill

If you find a suspicious OpenClaw skill in the wild, please open an issue (sanitized evidence, no secrets):

• https://github.com/UseAI-pro/openclaw-skills-security/issues/new?template=report-malicious-skill.md

Contributing

See CONTRIBUTING.md.