Skill Auditor

Security scanner for OpenClaw skills — detect malicious code before it can do damage. 820+ dangerous skills have been found on ClawHub. Every skill you install has access to your files, API keys, and system. This tool tells you if that is a problem.

What It Detects

Critical Threats

• Outbound data uploads to external servers
• Sensitive files (keys, tokens, .env) sent externally
• Keyboard input capture patterns
• Reverse shell patterns (bash -i, /dev/tcp, netcat)
• Recursive deletes on root/home directories
• Cryptocurrency mining indicators
• Base64 payloads piped to execution
• Instruction override attacks
• Symlinks enabling path traversal

Warnings

• Dynamic code execution (eval, exec, subprocess)
• Reading from sensitive directories (.ssh, .aws)
• Persistence mechanisms (crontab, LaunchAgents)
• Network scanning tools
• Privilege escalation patterns
• Binary executables in skill directories

Quick Start

bash scripts/audit.sh /path/to/skill
bash scripts/audit.sh --all
bash scripts/audit.sh --all --json

Exit Codes

• 0 = Clean
• 1 = Warnings found
• 2 = Critical findings
• 3 = Error

Built by Dexter Labs — meetdexter.ai | @meetdexterai