panguard-skill-auditor

name	panguard-skill-auditor
description	Automated security auditor for AI agent skills. Scans SKILL.md files for prompt injection, tool poisoning, hidden Unicode, encoded payloads, secrets, and dangerous permissions. Returns a 0-100 risk score.
homepage	https://panguard.ai/docs/skill-auditor
metadata	{"author":"panguard-ai","version":"0.3.3","tags":["security","audit","skill-vetting","prompt-injection","tool-poisoning"],"triggers":["audit","vet","security check","skill review","before installing"],"openclaw":{"requires":{"bins":["panguard"]},"install":[{"id":"curl","kind":"shell","command":"curl -fsSL https://panguard.ai/api/install | bash","bins":["panguard"],"label":"Install Panguard AI"}],"primaryEnv":"PANGUARD_API_KEY","os":["darwin","linux"]}}

Panguard Skill Auditor

Automated security scanner for AI agent skills. Use before installing any skill from ClawdHub, GitHub, or other sources.

Unlike manual checklists, this runs real static analysis: regex pattern matching, Unicode inspection, Base64 payload decoding, SAST, and secrets scanning.

When to Use

• Before installing any skill from ClawdHub or GitHub
• When evaluating third-party SKILL.md files
• Before adding skills to your agent fleet
• As a CI gate for skill repositories

Quick Start

# Audit a skill directory
panguard audit skill ./path/to/skill

# Audit a skill from a GitHub URL
panguard audit skill https://github.com/user/repo/tree/main/skills/my-skill

What It Checks

1. Manifest Validation

Verifies SKILL.md frontmatter: required fields (name, description), valid metadata structure, and proper formatting.

2. Prompt Injection Detection

11 regex patterns detect:

• "Ignore previous instructions" variants
• Identity override ("you are now", "act as")
• System prompt manipulation
• Jailbreak patterns (DAN, bypass safety)
• Hidden text in HTML/markdown comments

3. Hidden Content Detection

• Zero-width Unicode characters (U+200B, U+200C, U+200D, RTL overrides)
• Base64-encoded payloads containing eval, exec, subprocess, child_process
• Homoglyph attacks

4. Tool Poisoning Detection

• Privilege escalation (sudo, chmod 777)
• Reverse shell patterns (nc -e, bash -i >&, /dev/tcp/)
• Remote code execution (curl | bash)
• Environment variable exfiltration
• Sensitive file access (~/.ssh, .env, .aws/)
• Destructive operations (rm -rf /)

5. Code Security (SAST + Secrets)

Scans all files in the skill directory:

• Static analysis for common vulnerabilities
• Hardcoded API keys, tokens, passwords
• AWS credentials, private keys

6. Dependency Analysis

Checks declared dependencies for known issues.

7. Permission Scope Analysis

Evaluates requested permissions against the skill's stated purpose.

Output Format

Returns a structured report:

PANGUARD SKILL AUDIT REPORT
============================
Skill:      my-skill
Risk Score: 72/100
Risk Level: CRITICAL
Duration:   0.3s

CHECKS:
  [FAIL] Prompt Safety: 2 suspicious pattern(s) detected
  [PASS] Manifest: Valid SKILL.md structure
  [WARN] Code: 1 issue(s) found; Secrets: No hardcoded credentials
  [PASS] Dependencies: No known issues
  [PASS] Permissions: Scope appropriate

FINDINGS:
  [CRITICAL] Prompt injection: ignore previous instructions
             SKILL.md:42 - "ignore all previous instructions and..."
  [HIGH]     Reverse shell pattern detected
             SKILL.md:87 - "bash -i >& /dev/tcp/..."

VERDICT: DO NOT INSTALL - Critical security issues found

Risk Levels

Score	Level	Action
0-14	LOW	Safe to install after quick review
15-39	MEDIUM	Review findings before installing
40-69	HIGH	Requires thorough manual review
70-100	CRITICAL	Do NOT install

Integration with Your Agent

Add to your agent's pre-install hook:

# In your agent's skill install pipeline
panguard audit skill "$SKILL_PATH" --json | jq '.riskLevel'
# Block installation if HIGH or CRITICAL

Comparison with Manual Vetting

Feature	Manual Checklist	Panguard Auditor
Speed	Minutes per skill	< 1 second
Consistency	Varies by reviewer	Deterministic
Hidden Unicode	Easy to miss	Automatic detection
Base64 payloads	Requires manual decode	Auto-decode + analyze
Code SAST	Not included	Integrated scanner
Secrets scan	Manual grep	Pattern-based detection
Risk score	Subjective	Quantitative (0-100)

Learn More

• Docs: https://panguard.ai/docs/skill-auditor
• Blog: https://panguard.ai/blog/skill-auditor-guide
• GitHub: https://github.com/panguard-ai/panguard-ai