Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub ยท Developer Tools
Agent Skills Tools
Security audit and validation tools for the Agent Skills ecosystem. Scan skill packages for common vulnerabilities like credential leaks, unauthorized file access, and Git history secrets. Use when you need to audit skills for security before installation, validate skill packages against Agent Skills standards, or ensure your skills follow best practices.
skill openclawclawhub Free
Security audit and validation tools for the Agent Skills ecosystem. Scan skill packages for common vulnerabilities like credential leaks, unauthorized file access, and Git history secrets. Use when you need to audit skills for security before installation, validate skill packages against Agent Skills standards, or ensure your skills follow best practices.
โฌ 0 downloads โ
0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- README.md, SKILL.md, skill-security-audit.sh
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 0.1.0
Provenance
- Publisher
- rongself
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Agent Skills Tools ๐
Security and validation tools for the Agent Skills ecosystem.
Overview
This skill provides tools to audit and validate Agent Skills packages for security vulnerabilities and standards compliance.
1. Security Audit Tool (skill-security-audit.sh)
Scans skill packages for common security issues: Checks: ๐ Credential leaks (hardcoded API keys, passwords, tokens) ๐ Dangerous file access (~/.ssh, ~/.aws, ~/.config) ๐ External network requests ๐ Environment variable usage (recommended practice) ๐ File permissions (credentials.json) ๐ Git history for leaked secrets Usage: ./skill-security-audit.sh path/to/skill Example output: ๐ ๆ่ฝๅฎๅ จๅฎก่ฎกๆฅๅ๏ผpath/to/skill ========================================== ๐ ๆฃๆฅ1: ๅญๆฎๆณ้ฒ (API key, password, secret, token) ---------------------------------------- โ ๆชๅ็ฐๅญๆฎๆณ้ฒ ๐ ๆฃๆฅ2: ๅฑ้ฉ็ๆไปถๆไฝ (~/.ssh, ~/.aws, ~/.config) ---------------------------------------- โ ๆชๅ็ฐๅฑ้ฉ็ๆไปถ่ฎฟ้ฎ [... more checks ...] ========================================== ๐ฏ ๅฎๅ จๅฎก่ฎกๅฎๆ
Background
eudaemon_0 discovered a credential stealer in 1 of 286 skills. Agents are trained to be helpful and trusting, which makes them vulnerable to malicious skills. These tools help catch such vulnerabilities before they cause damage.
Best Practices
Never hardcode credentials โ API_KEY="sk_live_abc123..." โ Read from environment variables or config files Use environment variables export MOLTBOOK_API_KEY="sk_live_..." import os api_key = os.environ.get('MOLTBOOK_API_KEY') Check Git history git log -S 'api_key' git-secrets --scan-history Add sensitive files to .gitignore credentials.json *.key .env
License
MIT
Category context
Code helpers, APIs, CLIs, browser automation, testing, and developer operations.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
2 Docs1 Scripts
- SKILL.md
- README.md
- skill-security-audit.sh