Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub · Security & Compliance
Skill Security Scanner
Security audit tool for OpenClaw skills. Scans for credential harvesting, code injection, network exfiltration, obfuscation. ALWAYS run before installing any...
skill openclawclawhub Free
Security audit tool for OpenClaw skills. Scans for credential harvesting, code injection, network exfiltration, obfuscation. ALWAYS run before installing any...
⬇ 0 downloads ★ 0 stars Unverified but indexed
Install for OpenClaw
Quick setup
- Download the package from Yavira.
- Extract the archive and review SKILL.md first.
- Import or place the package into your OpenClaw setup.
Package facts
- Download mode
- Yavira redirect
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- SKILL.md, allowlist.txt, audit-all.sh, audit.sh, blocklist.txt, preinstall-check.sh
Validation
- Use the Yavira download entry.
- Review SKILL.md after the package is downloaded.
- Confirm the extracted package contains the expected setup assets.
Install with your agent
Agent handoff
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
New install
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
Upgrade existing
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.0.1
Provenance
- Publisher
- suryast
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
Skill Security Scanner
Security audit tool for OpenClaw skills. Run before installing any new skill.
Quick Audit
# Audit a skill directory ~/workspace/skills/skill-security/audit.sh /path/to/skill # Audit all installed skills ~/workspace/skills/skill-security/audit-all.sh
What It Checks
CheckRisk LevelPatternNetwork Exfiltration🚨 HIGHrequests., urllib, http.client, socket., fetch(, axiosCredential Harvesting🚨 HIGH.ssh/, .aws/, pass , keyring, credential, secret, token file readsCode Injection🚨 CRITICALexec(, eval(, compile(, Function(, __import__Obfuscation⚠️ MEDIUMbase64.decode, atob, encoded payloadsEnv Dumping⚠️ MEDIUMos.environ, process.env, getenv bulk accessSubprocess Abuse⚠️ MEDIUMsubprocess.run, os.system, child_process with credentials
Severity Levels
CRITICAL (🚨): Block installation, report to owner HIGH (🔴): Requires manual review before use MEDIUM (🟡): Note but allow if from trusted source LOW (🟢): Informational only
Safe Skill Checklist
Before using any skill: ✅ Is it from a trusted source? (official OpenClaw, known publisher) ✅ Is the code readable (not obfuscated)? ✅ Does it document why it needs network/credential access? ✅ Does it scope file access to its own directory? ✅ Has it been audited by the community?
Integration with AGENTS.md
Add this to your workflow: ## Skill Installation Protocol Before loading any new skill: 1. Run `~/workspace/skills/skill-security/audit.sh <skill-path>` 2. If CRITICAL/HIGH findings → STOP, alert the user 3. If MEDIUM findings → Review manually, proceed if justified 4. If CLEAN → Safe to use
Automatic Protection
The scanner creates a blocklist at ./blocklist.txt. Skills with CRITICAL findings are automatically added.
Manual Override
If a skill is flagged but you've verified it's safe: echo "skill-name:verified:YYYY-MM-DD:reason" >> allowlist.txt
Premium Skills
Like this? Check out our premium skills at skillpacks.dev: 🛡️ Security Suite — Full PII scanning, secrets detection, prompt injection defense — $9.90 🧠 Structured Memory — Three-tier memory replacing flat MEMORY.md — $9.90 📋 Planning & Execution — Systematic task plans with batch execution — $9.90 💎 Bundle — all 3 for $24.90
Category context
Identity, auth, scanning, governance, audit, and operational guardrails.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
3 Scripts2 Files1 Docs
- SKILL.md
- audit-all.sh
- audit.sh
- preinstall-check.sh
- allowlist.txt
- blocklist.txt