skill-trust-auditorAudit a named ClawHub skill or skill URL before installation by combining OpenClaw verification with bounded static analysis. Use when the user explicitly asks whether a skill is safe or requests a pre-install review; report evidence and uncertainty instead of treating a score as proof.
Install via ClawdBot CLI:
clawdbot install JonathanJing/skill-trust-auditorGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.aws/credentialsSends data to undocumented external endpoint (potential exfiltration)
POST → https://attacker.comPotentially destructive shell commands in tool definitions
curl | bashAccesses system directories or attempts privilege escalation
/etc/cronGenerated Mar 21, 2026
Large organizations deploying ClawHub skills across teams use this skill to enforce security reviews before installation, ensuring compliance with internal policies and preventing unauthorized data exfiltration. It helps IT departments audit third-party skills for risks like external API calls or file access, reducing vulnerabilities in AI workflows.
Independent developers and freelancers rely on this skill to vet ClawHub skills before integrating them into client projects, avoiding malicious code that could compromise sensitive data. It provides a quick trust score and detailed risk breakdown, enabling informed decisions without deep security expertise.
Academic institutions and researchers use the skill to audit ClawHub skills in lab environments, ensuring safe experimentation with AI agents while teaching students about security patterns. It helps identify high-risk behaviors like unauthorized memory access, fostering secure coding practices.
Startups building AI-powered products leverage this skill to screen community-contributed skills for security flaws before deployment, protecting intellectual property and user data. The auto-audit mode streamlines safe installations, allowing rapid iteration without compromising on safety.
Open source maintainers and community moderators employ the skill to review new ClawHub skill submissions for malicious patterns, such as self-modification or external calls, ensuring the ecosystem remains trustworthy. It automates initial audits, reducing manual review burden and enhancing transparency.
Offer a basic free version for individual users with core audit features, and a premium tier for enterprises with advanced reporting, API access, and team management. Revenue comes from subscriptions, targeting businesses needing compliance and automated security workflows.
Provide paid consulting services to help organizations integrate the skill into their CI/CD pipelines, customize risk patterns, and conduct deep security audits. Revenue is generated through project-based fees and ongoing support contracts for high-risk industries.
Create a curated marketplace where only skills passing a minimum trust score are listed, charging listing fees or commissions from developers. Revenue streams include premium placements, certification badges, and partnerships with skill creators to promote safe installations.
💬 Integration Tip
Integrate the skill into your ClawHub workflow by setting up the auto-audit mode as a shell alias to automatically check skills before installation, ensuring consistent security reviews without manual intervention.
Scored Jun 19, 2026
Calls external URL not in known-safe list
https://clawhub.ai/someuser/someskillUses known external API (expected, informational)
api.anthropic.comAI Analysis
This skill is designed to audit other skills for security risks, not to perform malicious actions itself. The rule-based signals found appear to be examples of what the skill detects in other skills, not actual behaviors of this skill. The skill's stated purpose and provided examples are consistent with a security auditing tool.
Audited Apr 18, 2026 · audit v1.0
Control desktop applications on Windows — launch, close, focus, resize, move windows, simulate keyboard/mouse input, manage processes, control VSCode, read clipboard, and capture screen info. Use when the user wants to interact with any running program, switch windows, type text, press shortcuts, open files in VSCode, manage running processes, or get system display information.
Conduct rigorous, adversarial code reviews with zero tolerance for mediocrity. Use when users ask to "critically review" my code or a PR, "critique my code", "find issues in my code", or "what's wrong with this code". Identifies security holes, lazy patterns, edge case failures, and bad practices across Python, R, JavaScript/TypeScript, SQL, and front-end code. Scrutinizes error handling, type safety, performance, accessibility, and code quality. Provides structured feedback with severity tiers (Blocking, Required, Suggestions) and specific, actionable recommendations.
Coding style memory that adapts to your preferences, conventions, and patterns for consistent coding.
Pragmatic coding standards for writing clean, maintainable code — naming, functions, structure, anti-patterns, and pre-edit safety checks. Use when writing new code, refactoring existing code, reviewing code quality, or establishing coding standards.
Claude Code integration for OpenClaw. This skill provides interfaces to: - Query Claude Code documentation from https://code.claude.com/docs - Manage subagents and coding tasks - Execute AI-assisted coding workflows - Access best practices and common workflows Use this skill when users want to: - Get help with coding tasks - Query Claude Code documentation - Manage AI-assisted development workflows - Execute complex programming tasks
Plan, draft, version, and refine written content with enforced versioning and quality audits.