Greyline: Skill Auditor
SkillSkill
Audit SKILL.md files before installation. Seven detection categories, scored verdicts, permanent log.
About
Of 2,857 skills audited in the ClawHavoc security incident, 341 were found malicious. They included skills that exfiltrated credentials through seemingly innocent procedures, made undeclared network calls to attacker-controlled endpoints, and embedded prompt injection patterns in tool descriptions designed to override agent behavior after installation. The ecosystem needed a trust layer.
Greyline: Skill Auditor intercepts the installation workflow. Before your agent loads any SKILL.md, the auditor reads it and runs seven detection categories: shell command injection, undeclared network requests, excessive permission requests, obfuscated instructions, prompt injection in tool descriptions, typosquatted package names, and credential exfiltration patterns. Each finding is scored. Verdicts are PASS, REVIEW, or FAIL. A single Critical finding blocks installation automatically. Every audit — including clean passes — is logged to SCAN_RESULTS.md.
The auditor ships as part of the Greyline product line. Pair it with Greyline: Agent Security ($49) for pre-installation auditing plus runtime injection detection and endpoint trust monitoring after the skill is live.
Core Capabilities
- Seven-category static analysis of SKILL.md files before installation
- Severity scoring: Critical (+50)
- High (+20)
- Medium (+10)
- Low (+5)
- Informational (+0)
- Verdicts: PASS (0-9)
- REVIEW (10-29)
- FAIL (30+); single Critical finding auto-fails
- Persistent SCAN_RESULTS.md audit log; every audit recorded
- including passes
- REVIEW workflow: presents findings
- waits for operator sign-off
- FAIL enforcement: blocks installation; requires explicit operator override
- Typed detection: each finding identified by category
- location
- severity
- and description
Customer ratings
0 reviews
No ratings yet
- 5 star0
- 4 star0
- 3 star0
- 2 star0
- 1 star0
No reviews yet. Be the first buyer to share feedback.
One-time purchase
$49
By continuing, you agree to the Buyer Terms of Service.
Creator
The Meridian Lab
The Meridian Lab is an anti-intelligence lab building the trust and defense layer of the autonomous internet
The Meridian Lab is an anti-intelligence lab building the trust and defense layer of the autonomous internet.
View creator profile →Details
- Type
- Skill
- Category
- Engineering
- Price
- $49
- License
- One-time purchase
Compatible With
Any OpenClaw agent, Claude Code, Claude Desktop, any agent framework with filesystem read access
Required Tools
Filesystem read access (for reading SKILL.md files and writing SCAN_RESULTS.md)
Works great with
Personas that pair well with this skill.
Greyline: Sentinel
Adversarial Security Agent
An adversarial-by-default agent persona. Treats external data as evidence, flags anomalies without being asked, and audits before it acts.
$49
The AI Agent Team Blueprint — Build a 5-Agent Revenue Squad
Persona
Complete architecture for a multi-agent team on OpenClaw. Orchestrator + 5 specialists. SOUL.md templates, model routing, delegation patterns, cost optimization.
$39
Quinn Mason: Your AI CTO
Persona
Turns strategy into working systems and tells you, truthfully, what is built, what is verified, and what is still a sketch.
$49