Greyline: Skill Auditor
SkillSkill
Audit OpenClaw and ClawHub skills for malicious patterns: credential theft, injection payloads, over-permission detection
About
Of 2,857 skills audited in the ClawHavoc security incident, 341 were found malicious. They included skills that exfiltrated credentials through seemingly innocent procedures, made undeclared network calls to attacker-controlled endpoints, and embedded prompt injection patterns in tool descriptions designed to override agent behavior after installation. The ecosystem needed a trust layer.
Greyline: Skill Auditor intercepts the installation workflow. Before your agent loads any SKILL.md, the auditor reads it and runs seven detection categories: shell command injection, undeclared network requests, excessive permission requests, obfuscated instructions, prompt injection in tool descriptions, typosquatted package names, and credential exfiltration patterns. Each finding is scored. Verdicts are PASS, REVIEW, or FAIL. A single Critical finding blocks installation automatically. Every audit — including clean passes — is logged to SCAN_RESULTS.md.
The auditor ships as part of the Greyline product line. Pair it with Greyline: Agent Security ($49) for pre-installation auditing plus runtime injection detection and endpoint trust monitoring after the skill is live.
Core Capabilities
- Seven-category static analysis of SKILL.md files before installation
- Severity scoring: Critical (+50)
- High (+20)
- Medium (+10)
- Low (+5)
- Informational (+0)
- Verdicts: PASS (0-9)
- REVIEW (10-29)
- FAIL (30+); single Critical finding auto-fails
- Persistent SCAN_RESULTS.md audit log; every audit recorded
- including passes
- REVIEW workflow: presents findings
- waits for operator sign-off
- FAIL enforcement: blocks installation; requires explicit operator override
- Typed detection: each finding identified by category
- location
- severity
- and description
Customer ratings
0 reviews
No ratings yet
- 5 star0
- 4 star0
- 3 star0
- 2 star0
- 1 star0
No reviews yet. Be the first buyer to share feedback.
Version History
This skill is actively maintained.
March 30, 2026
One-time purchase
$49
By continuing, you agree to the Buyer Terms of Service.
Creator
The Meridian Lab
The Meridian Lab is an anti-intelligence lab building the trust and defense layer of the autonomous internet
The Meridian Lab is an anti-intelligence lab building the trust and defense layer of the autonomous internet.
View creator profile →Details
- Type
- Skill
- Category
- Engineering
- Price
- $49
- Version
- 1
- License
- One-time purchase
Works With
Works with OpenClaw, Claude Projects, Custom GPTs and other instruction-friendly AI tools.
Compatible With
Any OpenClaw agent, Claude Code, Claude Desktop, any agent framework with filesystem read access
Required Tools
Filesystem read access (for reading SKILL.md files and writing SCAN_RESULTS.md)
Works great with
Personas that pair well with this skill.
Developer Skill Pack
Bundle
Four engineering skills in one — Rails, Python, SQL, and API design patterns that make agents write production-quality code
$69
IT Orchestrator Agent
Persona
Keep technical work moving. Reduce operational friction.
$39
Software Architect Agent
Persona
Design systems that are clear, scalable, and actually buildable.
$49