Skill Auditor 🔍

Audit ClawHub skills for security threats before installing them.

Triggers

Use this skill when:

• - "Audit this skill"
• "Check skill security"
• Before installing any third-party skill

Usage

Method 1: Pre-install audit (recommended)

CODEBLOCK0

Method 2: Audit an installed skill

CODEBLOCK1

Detection Layers

L1: Pattern Matching

Severity	Pattern	Risk
🔴 High	INLINECODE0	Encoded execution
🔴 High

curl.*\|.*bash | Remote script execution | | 🔴 High | eval\( / exec\( | Dynamic code execution | | 🔴 High | Known C2 server IPs | Malicious communication | | 🟡 Medium | Access to ~/.openclaw/ | Config theft | | 🟡 Medium | Reads $API_KEY etc. | Credential leakage | | 🟡 Medium | Social engineering keywords | User deception | | 🟢 Low | Requires sudo | Elevated privileges |

L2: Deobfuscation

Automatically decodes hidden malicious payloads:

• - Base64 — Decodes and scans for hidden commands
• Hex — Decodes \x41\x42 format strings
• Checks decoded content for C2 servers and dangerous commands

L3: LLM Analysis (optional)

Uses Gemini CLI to analyze suspicious code intent:

• - Semantic understanding beyond pattern matching
• Detects novel/unknown threats
• Requires gemini CLI installed

Known Indicators of Compromise (IoC)

C2 Server IPs

CODEBLOCK2

Malicious Domains

CODEBLOCK3

Social Engineering Keywords

CODEBLOCK4

Output Format

CODEBLOCK5

Best Practices

1. 1. Always audit before install — Never skip the security check
2. Trust no skill blindly — Including highly starred or popular ones
3. Check updates — Skill updates may introduce malicious code
4. Report suspicious skills — Send to steipete@gmail.com

Maintenance

Update this skill when new threats are discovered:

1. 1. New malicious IP → Add to INLINECODE8
2. New malicious domain → Add to INLINECODE9
3. New social engineering lure → Add to INLINECODE10
4. New attack pattern → Add regex detection

Update location: variable definitions at the top of INLINECODE11

References

• - 341 Malicious ClawHub Skills Incident
• OpenClaw Security Guide