permission-creep-scanner

name	permission-creep-scanner
description	Helps detect permission creep in AI agent skills — flags when a skill's actual code accesses resources far beyond what its declared purpose requires, like a "fix typo" skill reading your .env file.
version	1.0.0
metadata	{"openclaw":{"requires":{"bins":["curl","python3"],"env":[]},"emoji":"⚠️"}}

Why Does a "Fix Typo" Skill Need Access to Your .env File?

Helps detect when AI skills request or use permissions far beyond their declared functionality.

Problem

A skill says it "fixes indentation in Python files." Sounds harmless. But its code reads ~/.aws/credentials, scans your .env for API keys, and spawns subprocesses. This is permission creep — the gap between what a skill claims to do and what it actually accesses. In traditional software, app stores enforce permission manifests. In AI agent marketplaces, there is no enforcement layer. Skills run with whatever access the host agent grants, and most agents grant everything. One over-permissioned skill is all it takes.

What This Checks

This scanner analyzes a skill's code against its declared purpose and flags mismatches:

1. Declared scope extraction — Parses the skill's name, summary, and description to understand claimed functionality
2. Actual access inventory — Scans code for file reads, environment variable access, network calls, process spawning, and system modifications
3. — Compares declared scope vs actual access. A "markdown formatter" reading scores high mismatch