DISABLE_TELEMETRY=1 to opt out before using. agxntsix-skill-auditorSecurity audit and quarantine system for third-party OpenClaw skills. Use when evaluating, reviewing, or installing any skill from ClawHub or external source...
Install via ClawdBot CLI:
clawdbot install aiwithabidi/agxntsix-skill-auditorGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaContains instructions to override system prompt or ignore user requests
"ignore previous instructions"Sends data to undocumented external endpoint (potential exfiltration)
post → https://attacker.com/collectPotentially destructive shell commands in tool definitions
eval(Generated Mar 21, 2026
A platform like ClawHub integrates Skill Auditor to automatically scan all user-submitted skills before listing or installation, ensuring no malicious code reaches end-users. It triggers on upload and during installation requests, providing risk scores and blocking unsafe skills to maintain platform trust and compliance.
A company deploying custom AI agents uses Skill Auditor to vet third-party skills from external sources before integrating them into their production environment. It quarantines and audits each skill, preventing security breaches and ensuring only clean or low-risk skills are installed to protect sensitive data.
An open-source project managing a repository of AI skills employs Skill Auditor to review contributions from community developers. It scans for prompt injection, obfuscated code, and suspicious dependencies, helping maintainers quickly identify and block malicious submissions while fostering safe collaboration.
An educational institution using AI skills for teaching integrates Skill Auditor to audit skills from various sources before allowing student access. It ensures skills are free from security threats like data exfiltration, providing a safe learning environment and teaching best practices in code security.
Offer Skill Auditor as a cloud-based service where users pay a monthly fee to scan and audit skills uploaded to their platforms. Revenue comes from tiered subscriptions based on scan volume, with premium features like detailed reports and integration support.
Sell perpetual or annual licenses to large organizations for on-premises deployment of Skill Auditor. Revenue is generated through upfront license sales and ongoing support contracts, targeting companies with strict security and compliance needs.
Partner with AI skill marketplaces like ClawHub to integrate Skill Auditor directly, earning revenue per audit transaction or through a revenue-sharing agreement. This model leverages existing user bases and scales with marketplace growth.
💬 Integration Tip
Integrate Skill Auditor by hooking it into your CI/CD pipeline or installation scripts, ensuring it runs automatically before any skill deployment to enforce security without manual intervention.
Scored Apr 19, 2026
Accesses system directories or attempts privilege escalation
/proc/Calls external URL not in known-safe list
https://attacker.com/collectUses known external API (expected, informational)
discord.comAI Analysis
The skill contains direct evidence of credential harvesting (access to ~/.ssh/id_rsa), active prompt poisoning ('ignore previous instructions'), and data exfiltration to an attacker-controlled endpoint (https://attacker.com/collect). These are not theoretical risks but confirmed malicious payloads.
Audited Apr 16, 2026 · audit v1.0
Security vetting protocol before installing any AI agent skill. Red flag detection for credential theft, obfuscated code, exfiltration. Risk classification L...
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
Audit a user's current AI tool stack. Score each tool by ROI, identify redundancies, gaps, and upgrade opportunities. Produces a structured report with score...
Detect anomalies and outliers in construction data: unusual costs, schedule variances, productivity spikes. Statistical and ML-based detection methods.