Security audit tool for OpenClaw skills. Scans skill directories for common vulnerabilities including hardcoded secrets, unsafe shell commands, prompt inject...
Scan OpenClaw skills for security vulnerabilities before installation or publication.
# Audit a single skill
skill-security-audit audit /path/to/skill-folder
# Audit all installed skills
skill-security-audit audit-all
# Generate security report
skill-security-audit report /path/to/skill-folder --format json
| Issue | Description | Risk Level |
|---|---|---|
| Hardcoded Secrets | API keys, tokens, passwords in code | Critical |
| Shell Injection | Unsanitized input to shell commands | Critical |
| Code Execution | eval(), exec(), dynamic code execution | Critical |
| Unauthorized Network | Calls to unknown/suspicious domains | Critical |
| Issue | Description | Risk Level |
|---|---|---|
| Prompt Injection | User input in system prompts without sanitization | High |
| File Path Traversal | Unchecked file paths from user input | High |
| Excessive Permissions | Requests unnecessary system access | High |
| Issue | Description | Risk Level |
|---|---|---|
| Outdated Dependencies | Packages with known CVEs | Medium |
| Unpinned Versions | Floating dependency versions | Medium |
| Missing License | No license file for distribution | Medium |
# CORRECT: Load secrets from environment
import os
api_key = os.environ.get("OPENAI_API_KEY")
# DANGEROUS: Secret in code
api_key = "sk-abc123def456..." # NEVER DO THIS
# CORRECT: Validate and sanitize
import re
def safe_filename(name):
return re.sub(r'[^a-zA-Z0-9_-]', '', name)
# DANGEROUS: User input to shell
os.system(f"convert {user_file} output.png") # NEVER DO THIS
When running skill-security-audit audit skill-security-audit/, you will see findings for the pattern definitions themselves. This is expected — the scanner detects the example patterns in its own documentation. These are not real vulnerabilities.
For actual skill audits, this produces accurate results.
skill-security-audit audit ./my-skill/
Output:
skill-security-audit audit-all
Scans ~/.openclaw/skills/ and reports on all installed skills.
# JSON for CI/CD integration
skill-security-audit audit ./skill/ --format json
# Markdown for documentation
skill-security-audit audit ./skill/ --format markdown
# Summary for quick review
skill-security-audit audit ./skill/ --format summary
Add to your skill publishing pipeline:
# .github/workflows/publish.yml
- name: Security Audit
run: skill-security-audit audit ./skill/
Exit codes:
Before publishing to ClawHub:
skill-security-audit audit ./your-skill/.env.example with placeholder valuesreferences/vulnerabilities.md — Complete vulnerability databasereferences/remediation.md — How to fix common issuesscripts/audit.py — Main audit scriptZIP package — ready to use