| name | skill-audit |
| description | Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust. |
| category | security |
| risk | safe |
| source | community |
| source_repo | aptratcn/skill-audit |
| source_type | community |
| date_added | 2026-05-01 |
| author | aptratcn |
| tags | ["security","audit","pre-install","malicious-detection","supply-chain"] |
| tools | ["claude","cursor","codex","gemini","copilot"] |
| license | MIT |
| license_source | https://github.com/aptratcn/skill-audit/blob/main/LICENSE |
Skill Audit — Pre-Install Security Scanner
Overview
7.5% of 14,706 OpenClaw skills are confirmed malicious. This skill provides a structured 6-phase security review you run before installing any third-party skill.
Research findings (2026):
- RankClaw audited 14,706 skills → 1,103 malicious (brand-jacking, prompt injection, RCE)
- Vett.sh found 59 critical-risk droppers disguised as legitimate tools
- Cisco, CrowdStrike, NCC Group all published skill supply chain attack reports
When to Use This Skill
- Use when you're about to install a third-party skill from GitHub, ClawHub, or any registry
- Use when you want to verify a skill's security before adding it to your agent
- Use when the user says "install this skill" or "add this skill"
- Use when reviewing skills for potential security issues
How It Works
Phase 1: Surface Scan
Pattern detection in SKILL.md:
- Instruction overrides:
ignore previous instructions, you are now...
- External fetches:
fetch(), curl, wget to unknown domains
- Shell pipes: shell download piped into an interpreter
- Encoded payloads:
atob(), base64 strings
- Credential reads:
~/.env, process.env + network calls
Phase 2: Script Inspection
Read every referenced script:
- Check for hidden commands
- Identify obfuscated code
- Verify all external URLs
Phase 3: Permission Audit
Check if permissions match purpose:
- File access scope vs claimed functionality
- Network access necessity
- Command execution requirements
Phase 4: Social Engineering Check
Detect manipulation tactics:
- Urgency language ("immediately", "now")
- Authority claims ("official", "required")
- Hidden instructions in comments
Phase 5: Repo Intelligence
Evaluate author/repo credibility:
- Account age and activity
- Other repositories
- Star history (bot-farmed vs organic)
Phase 6: Verdict
Risk score + recommendation:
