Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub Β· Finance & Trading
Skill Auditor v2
Security scanner for OpenClaw skills. Detects malicious code, obfuscated payloads, prompt injection, social engineering, typosquatting, and data exfiltration...
skill openclawclawhub Free
Security scanner for OpenClaw skills. Detects malicious code, obfuscated payloads, prompt injection, social engineering, typosquatting, and data exfiltration...
β¬ 0 downloads β
0 stars Unverified but indexed
Install for OpenClaw
Known item issue.
This item's current download entry is known to bounce back to a listing or homepage instead of returning a package file.
Quick setup
- Open the source page and confirm the package flow manually.
- Review SKILL.md if you can obtain the files.
- Treat this source as manual setup until the download is verified.
Package facts
- Download mode
- Manual review
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- SKILL.md, references/ioc-database.json, references/known-patterns.md, references/prompt-injection-patterns.md, scripts/audit_skill.py, scripts/quarantine.sh
Validation
- Open the source listing and confirm there is a real package or setup artifact available.
- Review SKILL.md before asking your agent to continue.
- Treat this source as manual setup until the upstream download flow is fixed.
Install with your agent
Agent handoff
Use the source page and any available docs to guide the install because the item currently does not return a direct package file.
- Open the source page via Open source listing.
- If you can obtain the package, extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the source page and extracted files.
New install
I tried to install a skill package from Yavira, but the item currently does not return a direct package file. Inspect the source page and any extracted docs, then tell me what you can confirm and any manual steps still required.
Upgrade existing
I tried to upgrade a skill package from Yavira, but the item currently does not return a direct package file. Compare the source page and any extracted docs with my current installation, then summarize what changed and what manual follow-up I still need.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 2.0.0
Provenance
- Publisher
- aiwithabidi
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Skill Auditor v2.0 ππ‘οΈ
Comprehensive security scanner for OpenClaw/ClawHub skills. Merges static analysis, deobfuscation, and threat intelligence into a single Python tool.
When to Use
Before installing any third-party skill from ClawHub When reviewing skill updates for security regressions To audit your own skills before publishing When someone asks: "is this skill safe?", "audit this", "check security"
Audit a local skill directory
python3 {baseDir}/scripts/audit_skill.py /path/to/skill --human
Audit a ClawHub skill by slug
python3 {baseDir}/scripts/audit_skill.py --slug skill-name --human
Quarantine workflow (audit + prompt to install)
bash {baseDir}/scripts/quarantine.sh /path/to/skill bash {baseDir}/scripts/quarantine.sh --slug skill-name
JSON output for programmatic use
python3 {baseDir}/scripts/audit_skill.py /path/to/skill --json
Scoring System
ScoreLevelAction0β20β SAFEAuto-install OK21β40π’ LOW RISKProceed with caution41β60π‘ MEDIUM RISKManual review required61β80π HIGH RISKExpert review needed81β100π΄ CRITICALDo NOT install Exit codes: 0 = safe (β€20), 1 = review (21β60), 2 = dangerous (>60)
Layer 1: Static Pattern Analysis
10+ scan categories with regex patterns Shell execution, network calls, env access, filesystem escape Prompt injection, data exfiltration, crypto wallet access Dynamic imports, browser credential theft, fake prerequisites
Layer 2: Deobfuscation
Base64 string extraction and decode β re-scan decoded content Hex escape sequence decode β re-scan Detects hidden commands, C2 IPs in encoded payloads
Layer 3: Threat Intelligence
IoC database: known malicious IPs, domains Social engineering detection: urgency, false authority, fear tactics MITRE ATT&CK ID mapping on every finding Whitelist system reduces score for safe binaries/domains
Additional Checks
SHA256 file inventory for integrity verification Typosquat detection (Levenshtein distance on package names) Zero-width character detection in SKILL.md Comment-context severity reduction (findings in comments scored lower) Permission scope analysis (what tools does the skill request?)
IoC Database
Structured threat data in references/ioc-database.json. Update when new threats emerge. The scanner auto-loads this file at runtime.
References
references/ioc-database.json β Structured IoC data (IPs, domains, patterns) references/known-patterns.md β Human-readable threat documentation references/prompt-injection-patterns.md β Prompt injection pattern reference
Credits
Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents. π Need help setting up OpenClaw for your business? Book a free consultation Fork of skill-auditor-pro by sypsyp97, merged with skill-security-auditor by akm626.
Category context
Trading, swaps, payments, treasury, liquidity, and crypto-financial operations.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
3 Docs2 Scripts1 Config
- SKILL.md
- references/known-patterns.md
- references/prompt-injection-patterns.md
- scripts/audit_skill.py
- scripts/quarantine.sh
- references/ioc-database.json