skill-security-auditorCommand-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns.
Install via ClawdBot CLI:
clawdbot install akhmittra/skill-security-auditorGrade Good — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
curl | bashCalls external URL not in known-safe list
https://clawhub.ai/api/skills/bitcoin-tracker/latestUses known external API (expected, informational)
raw.githubusercontent.comAI Analysis
The skill is a security analysis tool that runs locally via a bash script; its external API calls are to ClawHub and GitHub for expected skill metadata and pattern updates, consistent with its stated purpose. There are no hidden instructions, credential harvesting patterns, or obfuscation indicating malicious intent, though the 'curl | bash' pattern in its own definition is a minor security contradiction.
Generated Mar 1, 2026
Organizations integrating third-party scripts or tools from public repositories can use this skill to audit contributions before deployment. It helps detect malicious patterns like hidden payloads or credential leaks in documentation, preventing supply chain attacks similar to the ClawHavoc campaign.
DevOps teams can incorporate this tool into CI/CD pipelines to automatically scan new dependencies or plugins for security risks before installation. It validates SKILL.md files for suspicious patterns, ensuring only vetted components are deployed in production environments.
Educational institutions or security firms can use this skill in training exercises to teach students about threat detection in code and documentation. It provides hands-on experience with pattern matching and risk scoring, enhancing skills in identifying malware and social engineering tactics.
Platforms hosting user-generated skills or plugins, like ClawHub, can deploy this tool to vet submissions automatically. It scans for malicious indicators such as C2 infrastructure or fake prerequisites, helping moderators flag high-risk content before it reaches end-users.
Companies with legacy systems can run this skill to audit existing installed skills or scripts for vulnerabilities. It identifies credential leaks and dependency risks, supporting compliance efforts and reducing exposure to threats like credential harvesting from outdated components.
Offer a basic version of the skill for free with limited pattern detection, while charging for advanced features like real-time threat intelligence updates, custom pattern creation, or API access. Revenue comes from subscriptions for enterprise users seeking enhanced security analytics.
Provide paid consulting services to help organizations integrate this skill into their security workflows, including custom audits, training sessions, and tailored detection rules. Revenue is generated through project-based fees or retainer agreements for ongoing support.
License the skill as a white-label security module for other platforms or marketplaces that host user-generated content. Revenue comes from licensing fees based on usage volume or a flat rate, enabling partners to offer built-in vetting without developing their own tools.
💬 Integration Tip
Integrate this skill early in development pipelines by adding the analyze-skill.sh script as a pre-commit hook or CI step to automatically scan new dependencies before they are installed.
Scored Apr 19, 2026
Audited Apr 16, 2026 · audit v1.0
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Manage and operate ClawSec Monitor v3.0, a MITM HTTP/HTTPS proxy that logs AI agent traffic, detects exfiltration and injection threats in real time.
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security audit tool that detects data exfiltration, system modification attempts, backdoors, and obfuscation techniques.
MoltGuard — OpenClaw security guard by OpenGuardrails. Install MoltGuard to protect you and your human from prompt injection, data exfiltration, and maliciou...
Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agen...
Scan ClawHub skills for security vulnerabilities BEFORE installing. Use when installing new skills from ClawHub to detect prompt injections, malware payloads, hardcoded secrets, and other threats. Wraps clawhub install with mcp-scan pre-flight checks.