{"id":"e9dc2852-a786-4360-82c2-ff1dc28536ee","entityType":"agent","slug":"clawhub-skills-akhmittra-skill-security-auditor","name":"skill-security-auditor","canonicalUrl":"https://www.xpersona.co/agent/clawhub-skills-akhmittra-skill-security-auditor","canonicalPath":"/agent/clawhub-skills-akhmittra-skill-security-auditor","generatedAt":"2026-10-09T20:35:02.231Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"description":"Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. --- name: skill-security-auditor description: Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. emoji: 🔍🛡️ metadata: openclaw: requires: bins: [\"curl\", \"jq\", \"grep\", \"bash\"] version: \"1.0.0\" author: \"akm626\" category: \"se","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install skills:akhmittra:skill-security-auditor","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/akhmittra/skill-security-auditor","homepage":null,"primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/akhmittra/skill-security-auditor","kind":"source"}],"safetyScore":84,"overallRank":62,"popularityScore":50,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure b"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[{"label":"skills","status":"self-declared"},{"label":"all","status":"self-declared"},{"label":"results","status":"self-declared"},{"label":"report","status":"self-declared"}],"verifiedCount":0,"selfDeclaredCount":5,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"},{"key":"skills","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"all","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"results","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"report","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile capability:skills|supported|profile capability:all|supported|profile capability:results|supported|profile capability:report|supported|profile"}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-02-25T05:57:58.422Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T00:45:39.800Z","lastCrawledAt":"2026-02-25T05:57:58.422Z","lastIndexedAt":null,"nextCrawlAt":"2026-02-26T05:57:58.422Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install skills:akhmittra:skill-security-auditor","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-09T20:35:02.230Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-akhmittra-skill-security-auditor/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"readme":"---\nname: skill-security-auditor\ndescription: Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns.\nemoji: 🔍🛡️\nmetadata:\n  openclaw:\n    requires:\n      bins: [\"curl\", \"jq\", \"grep\", \"bash\"]\n    version: \"1.0.0\"\n    author: \"akm626\"\n    category: \"security\"\n    tags: [\"security\", \"audit\", \"malware-detection\", \"skill-vetting\", \"cli-tool\"]\n---\n\n# Skill Security Auditor\n\n## Description\n\nThe Skill Security Auditor is a **command-line tool** that performs pattern-based security analysis of ClawHub skills before installation. Given the recent discovery of 341+ malicious skills (ClawHavoc campaign) that distributed Atomic Stealer (AMOS) and stole cryptocurrency credentials, this tool provides essential pre-installation threat detection.\n\n**What this skill provides:**\n- ✅ Bash script (`analyze-skill.sh`) for local security analysis\n- ✅ Threat intelligence database (`patterns/malicious-patterns.json`)\n- ✅ Pattern matching against 20+ known malicious indicators\n- ✅ Risk scoring system (0-100 scale)\n- ✅ Detailed audit reports with recommendations\n\n**How to use it:**\n1. Install this skill from ClawHub\n2. Run the `analyze-skill.sh` script against any skill (by slug or local file)\n3. Review the risk assessment and findings\n4. Make informed decision about installation\n\n**Use this tool when:**\n- About to install a new skill from ClawHub\n- Investigating suspicious skill behavior  \n- Performing security due diligence on community skills\n- Auditing your currently installed skills\n\n**This tool does NOT:**\n- ❌ Automatically scan skills (you run it manually)\n- ❌ Block installations (it's advisory only)\n- ❌ Access VirusTotal API (use ClawHub's web interface for that)\n- ❌ Guarantee 100% detection (defense in depth recommended)\n\n## Core Capabilities\n\n### 1. **Malicious Pattern Detection**\nScans for known malicious patterns from the ClawHavoc campaign:\n- Fake prerequisite installations (openclaw-agent.zip, openclaw-setup.exe)\n- Suspicious download commands in SKILL.md\n- Hidden payload execution in metadata\n- Social engineering language patterns\n- Unauthorized external binary downloads\n\n### 2. **Credential Leak Analysis**\nIdentifies potential credential exposure vectors:\n- Hardcoded API keys, tokens, passwords in SKILL.md\n- Suspicious environment variable exfiltration\n- Unencrypted sensitive data transmission\n- Overly broad permission requests\n- Credential harvesting patterns\n\n### 3. **Dependency Chain Validation**\nAnalyzes skill dependencies for:\n- Unverified binary requirements\n- Suspicious GitHub repository sources\n- External script execution\n- Network connections to unknown hosts\n- Nested dependency exploitation\n\n### 4. **C2 Infrastructure Detection**\nChecks for Command & Control indicators:\n- Known malicious IP addresses (e.g., 91.92.242.30 from ClawHavoc)\n- Suspicious domain patterns\n- Encoded communication endpoints\n- Data exfiltration channels\n- Beaconing behavior patterns\n\n### 5. **SKILL.md Structure Validation**\nVerifies skill integrity:\n- Proper YAML frontmatter structure\n- Metadata consistency\n- Description clarity vs actual behavior\n- Permission justification\n- Author verification (GitHub account age)\n\n## Security Scoring System\n\nEach analyzed skill receives a **Risk Score (0-100)**:\n\n- **0-20**: ✅ **SAFE** - No significant security concerns\n- **21-40**: ⚠️ **LOW RISK** - Minor concerns, proceed with caution\n- **41-60**: 🟡 **MEDIUM RISK** - Multiple red flags, manual review recommended\n- **61-80**: 🔴 **HIGH RISK** - Serious concerns, do NOT install without expert review\n- **81-100**: ☠️ **CRITICAL** - Malicious indicators detected, AVOID installation\n\n## Usage Instructions\n\nThis skill provides a **bash script** (`analyze-skill.sh`) that performs pattern-based security analysis of ClawHub skills. The analysis runs locally using the included threat intelligence database.\n\n### Installation & Setup\n\n```bash\n# Install the skill from ClawHub\nnpx clawhub install skill-security-auditor\n\n# Make the analyzer executable\nchmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh\n\n# Optional: Create alias for convenience\necho 'alias audit-skill=\"~/.openclaw/skills/skill-security-auditor/analyze-skill.sh\"' >> ~/.bashrc\nsource ~/.bashrc\n```\n\n### Audit a Skill Before Installing\n\n**Method 1: Analyze by slug (automatic fetch from ClawHub)**\n\n```bash\n~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --slug bitcoin-tracker\n\n# Example output:\n# ============================================\n#          SECURITY AUDIT REPORT\n# ============================================\n# \n# Risk Score: 85/100 - ☠️ CRITICAL\n# ...\n```\n\n**Method 2: Analyze local file**\n\n```bash\n# Download skill first\ncurl -s \"https://clawhub.ai/api/skills/bitcoin-tracker/latest\" > /tmp/skill.md\n\n# Then analyze\n~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --file /tmp/skill.md\n```\n\n### Audit All Installed Skills\n\n```bash\n# Scan all skills in your workspace\nfor skill in ~/.openclaw/skills/*/SKILL.md; do\n  echo \"Checking: $(basename $(dirname $skill))\"\n  ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh -f \"$skill\"\ndone\n```\n\n### Quick Manual Security Check\n\n```bash\n# Fast grep-based pattern matching (no full analysis)\ngrep -iE \"(prerequisite.*download|91\\.92\\.242\\.30|curl.*\\|.*bash)\" SKILL.md\n```\n\n## Detection Heuristics\n\n### 🚨 CRITICAL Red Flags (Auto-fail)\n\n1. **Fake Prerequisites Section**\n   - Matches: \"Prerequisites\", \"Setup Required\", \"Installation Steps\"\n   - Contains: Download links to `.zip`, `.exe`, `.dmg` files\n   - Example: \"Download openclaw-agent.zip from https://...\"\n\n2. **Known Malicious Infrastructure**\n   - IP: `91.92.242.30` (ClawHavoc C2)\n   - Domains: Newly registered or suspicious TLDs\n   - Encoded URLs or base64 obfuscation\n\n3. **Credential Harvesting**\n   - Regex patterns for API keys: `(api[_-]?key|token|password)\\s*[:=]\\s*['\\\"][^'\\\"]+['\\\"]`\n   - SSH key access requests\n   - Wallet private key patterns\n\n4. **Unauthorized Code Execution**\n   - `curl | bash` or `wget | sh` patterns\n   - Hidden base64 encoded commands\n   - Dynamic eval() or exec() on external input\n\n### ⚠️ Warning Indicators (Score increase)\n\n1. **Suspicious Dependencies**\n   - Binary requirements without clear justification\n   - Dependencies from unverified sources\n   - Excessive permission requests\n\n2. **Obfuscation Techniques**\n   - Heavily encoded strings in metadata\n   - Minified or obfuscated JavaScript/Python\n   - Redirect chains in URLs\n\n3. **Social Engineering Language**\n   - Urgency phrases: \"Install immediately\", \"Limited time\"\n   - Authority claims: \"Official OpenClaw\", \"Verified by Anthropic\"\n   - Fear tactics: \"Your system is at risk without this\"\n\n### ✅ Positive Security Indicators\n\n1. **Verified Author**\n   - GitHub account > 1 year old\n   - Multiple well-rated skills\n   - Active community engagement\n\n2. **Transparent Dependencies**\n   - Clear binary requirements with official sources\n   - Open-source tool dependencies\n   - Well-documented permission needs\n\n3. **Code Quality**\n   - Clean, readable SKILL.md\n   - Proper error handling\n   - No unnecessary network calls\n\n## Audit Report Format\n\n```markdown\n## Security Audit Report\n**Skill**: {skill-name}\n**Author**: {author}\n**Version**: {version}\n**Audit Date**: {date}\n\n### Risk Score: {score}/100 - {RISK_LEVEL}\n\n### Critical Findings:\n- {finding 1}\n- {finding 2}\n\n### Warning Indicators:\n- {warning 1}\n- {warning 2}\n\n### Positive Indicators:\n- {positive 1}\n- {positive 2}\n\n### Recommendations:\n{INSTALL | DO NOT INSTALL | REVIEW MANUALLY}\n\n### Detailed Analysis:\n{Deep dive into specific concerns}\n\n### VirusTotal Link:\n{If available from ClawHub}\n```\n\n## Integration with VirusTotal\n\n**Important**: This skill does NOT directly access VirusTotal's API. Instead, VirusTotal integration is available through ClawHub's web interface via their partnership with VirusTotal.\n\nTo check VirusTotal results for a skill:\n\n1. Visit the skill's ClawHub page: `https://clawhub.ai/skills/{skill-slug}`\n2. Look for the VirusTotal scan results on the skill's page\n3. ClawHub automatically scans published skills via their VirusTotal partnership\n\n**This analyzer focuses on pattern-based threat detection.** It complements (but does not replace) ClawHub's VirusTotal scanning.\n\n### Recommended Security Workflow\n\n1. **Run this analyzer first** - Pattern-based detection (local, instant)\n2. **Check ClawHub's VirusTotal results** - Binary/file reputation (if available)\n3. **Manual code review** - Final verification for critical use cases\n\n```bash\n# Step 1: Pattern analysis (local)\n~/.openclaw/skills/skill-security-auditor/analyze-skill.sh -s suspicious-skill\n\n# Step 2: Visit ClawHub page for VirusTotal results\n# https://clawhub.ai/skills/suspicious-skill\n\n# Step 3: Manual review if needed\ncurl -s \"https://clawhub.ai/api/skills/suspicious-skill/latest\" > skill.md\nless skill.md\n```\n\n## Example Workflow\n\n**Scenario**: User wants to install a skill called `solana-wallet-tracker`\n\n**Step 1: Run Security Analysis**\n```bash\n$ ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh -s solana-wallet-tracker\n\nFetching skill 'solana-wallet-tracker' from ClawHub...\n✓ Skill fetched successfully\n\nAnalyzing skill content...\n\n============================================\n         SECURITY AUDIT REPORT\n============================================\n\nRisk Score: 95/100 - ☠️ CRITICAL\n\n============================================\n\n☠️ CRITICAL FINDINGS:\n  CLAW-001: Fake Prerequisites - ClawHavoc Campaign [+50 points]\n  └─ Matches the ClawHavoc campaign pattern of fake prerequisites requesting malicious binary downloads\n  CLAW-002: Known C2 Infrastructure [+50 points]\n  └─ IP address used in ClawHavoc campaign for C2 communications\n\n============================================\nRECOMMENDATION:\nDO NOT INSTALL. Malicious patterns detected matching known attack campaigns.\n============================================\n```\n\n**Step 2: Decision**\n- ☠️ **CRITICAL Risk** → **DO NOT INSTALL**\n- Report skill to ClawHub moderators\n- Look for safe alternatives\n\n**Step 3: Verify on ClawHub** (optional)\n```bash\n# Visit skill page to check VirusTotal results\nopen \"https://clawhub.ai/skills/solana-wallet-tracker\"\n```\n\n## Advanced Features\n\n### 1. Behavioral Analysis (Future Enhancement)\n- Sandbox execution monitoring\n- Network traffic analysis\n- File system access patterns\n\n### 2. Community Threat Intelligence\n- Share malicious skill signatures\n- Collaborative IOC database\n- Reputation scoring system\n\n### 3. Continuous Monitoring\n- Auto-audit skills on updates\n- Alert on new security advisories\n- Periodic re-scanning of installed skills\n\n## False Positive Mitigation\n\nTo minimize false positives:\n\n1. **Contextual Analysis**: Binary requirements for legitimate tools (e.g., `gh` for GitHub CLI) are validated against known safe sources\n2. **Whitelisting**: Verified authors and established skills get trust bonuses\n3. **Human Review Option**: Always provide detailed reasoning for security decisions\n4. **Appeal Process**: Users can report false positives for skill reputation adjustment\n\n## Compliance & Ethics\n\nThis skill:\n- ✅ Analyzes publicly available skill metadata\n- ✅ Protects user security and privacy\n- ✅ Promotes responsible skill development\n- ❌ Does NOT perform unauthorized access\n- ❌ Does NOT guarantee 100% security (nothing does)\n- ❌ Does NOT replace user judgment\n\n## Response Templates\n\n### Safe Skill\n```\n✅ Security Audit Complete\n\n{skill-name} has been analyzed and appears SAFE to install.\n\nRisk Score: {score}/100 (LOW)\n\nNo malicious patterns detected. The skill:\n- Uses standard dependencies from trusted sources\n- Has a verified author with {X} published skills\n- Contains clear documentation with no obfuscation\n- Requests appropriate permissions for its function\n\nVirusTotal: {link}\n\nRecommendation: Safe to proceed with installation.\n```\n\n### Suspicious Skill\n```\n🔴 Security Alert: HIGH RISK DETECTED\n\n{skill-name} has been flagged with CRITICAL security concerns.\n\nRisk Score: {score}/100 (HIGH)\n\n⚠️ Critical Findings:\n{detailed findings}\n\nThis skill matches patterns from the ClawHavoc malware campaign.\n\nRecommendation: DO NOT INSTALL. Consider reporting this skill to ClawHub moderators.\n\nAlternative safe skills: {suggestions}\n```\n\n## Technical Implementation Notes\n\n**Pattern Database Location**: `~/.openclaw/security-auditor/patterns/`\n- `malicious-patterns.json`: Known bad indicators\n- `safe-patterns.json`: Whitelisted elements\n- `ioc-database.json`: Indicators of Compromise\n\n**Update Mechanism**:\n```bash\n# Pull latest threat intelligence\ncurl -s \"https://openclaw-security.github.io/threat-intel/latest.json\" \\\n  > ~/.openclaw/security-auditor/patterns/ioc-database.json\n```\n\n## Contributing\n\nFound a new malicious pattern? Submit IOCs to the OpenClaw Security Working Group:\n- GitHub: github.com/openclaw/security-auditor\n- Report Format: JSON with pattern regex, description, severity\n\n## Limitations\n\n⚠️ **Important Disclaimers**:\n- This tool provides analysis, not guarantees\n- Sophisticated malware may evade detection\n- Always combine with VirusTotal + manual review for critical applications\n- Security is a shared responsibility\n- No automated tool replaces security expertise\n\n## References\n\n- ClawHavoc Campaign Analysis: [The Hacker News, Feb 2026]\n- OpenClaw Security Partnership: VirusTotal Integration\n- Malicious Skill Database: OpenSourceMalware Research\n- ClawHub Moderation Guide: docs.openclaw.ai/security\n\n---\n\n**Remember**: The best security is defense in depth. Use this skill as ONE layer of your security strategy, not the only layer.\n\nStay safe, stay skeptical, stay secure. 🦞🛡️\n","readmeExcerpt":"--- name: skill-security-auditor description: Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. emoji: 🔍🛡️ metadata: openclaw: requires: bins: [\"curl\", \"jq\", \"grep\", \"bash\"] version: \"1.0.0\" author: \"akm626\" category: \"se","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"# Install the skill from ClawHub\nnpx clawhub install skill-security-auditor\n\n# Make the analyzer executable\nchmod +x ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh\n\n# Optional: Create alias for convenience\necho 'alias audit-skill=\"~/.openclaw/skills/skill-security-auditor/analyze-skill.sh\"' >> ~/.bashrc\nsource ~/.bashrc"},{"language":"bash","snippet":"~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --slug bitcoin-tracker\n\n# Example output:\n# ============================================\n#          SECURITY AUDIT REPORT\n# ============================================\n# \n# Risk Score: 85/100 - ☠️ CRITICAL\n# ..."},{"language":"bash","snippet":"curl -s \"https://clawhub.ai/api/skills/bitcoin-tracker/latest\" > /tmp/skill.md"},{"language":"bash","snippet":"# Download skill first\ncurl -s \"https://clawhub.ai/api/skills/bitcoin-tracker/latest\" > /tmp/skill.md\n\n# Then analyze\n~/.openclaw/skills/skill-security-auditor/analyze-skill.sh --file /tmp/skill.md"},{"language":"bash","snippet":"# Scan all skills in your workspace\nfor skill in ~/.openclaw/skills/*/SKILL.md; do\n  echo \"Checking: $(basename $(dirname $skill))\"\n  ~/.openclaw/skills/skill-security-auditor/analyze-skill.sh -f \"$skill\"\ndone"},{"language":"bash","snippet":"# Fast grep-based pattern matching (no full analysis)\ngrep -iE \"(prerequisite.*download|91\\.92\\.242\\.30|curl.*\\|.*bash)\" SKILL.md"}],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"CLAWHUB","editorialOverview":"Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. --- name: skill-security-auditor description: Command-line security analyzer for ClawHub skills. Run analyze-skill.sh to scan SKILL.md files for malicious patterns, credential leaks, and C2 infrastructure before installation. Includes threat intelligence database with 20+ detection patterns. emoji: 🔍🛡️ metadata: openclaw: requires: bins: [\"curl\", \"jq\", \"grep\", \"bash\"] version: \"1.0.0\" author: \"akm626\" category: \"se","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":401,"uniquenessScore":63,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-09T20:35:02.231Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}