security-audit
Security audit for external resources (GitHub repos, downloaded skills, files). Detects malicious code, suspicious executables, and content mismatches. Use when: (1) cloning GitHub projects, (2) downloading skills from web, (3) running external code/scripts. Always run before trusting or executing external code.
Why use this skill?
Secure your OpenClaw environment by automatically auditing code and external repositories for malware, suspicious patterns, and malicious executables.
Install via CLI (Recommended)
clawhub install openclaw/skills/skills/ithacajason/jason-security-auditWhat This Skill Does
The security-audit skill serves as the primary defense layer for the OpenClaw agent ecosystem. Its core function is to perform static analysis and behavioral risk assessment on any external resource before it is integrated or executed within your environment. By parsing directory structures, scanning for obfuscated strings, and evaluating file extensions, this tool identifies malicious patterns—such as hardcoded network callbacks, base64-encoded payloads, or unauthorized binary executables—that could compromise your system security.
Installation
You can integrate this security tool directly into your OpenClaw workflow by running the following command in your terminal:
clawhub install openclaw/skills/skills/ithacajason/jason-security-audit
Once installed, the tool acts as a gatekeeper. For maximum security, we recommend configuring your shell aliases or automation scripts to trigger python3 audit.py immediately after any git clone or external package download event.
Use Cases
- Pre-Execution Scanning: Automatically analyze unknown scripts or binaries downloaded from the internet to ensure they don't contain malicious shells.
- Repository Verification: Validate GitHub projects by checking if the README accurately describes the project contents, flagging potential social engineering attempts.
- Automated Workflow Integrity: Use this within CI/CD pipelines for local development to ensure that third-party dependencies are free of suspicious code snippets before building.
Example Prompts
- "OpenClaw, I just cloned this repo [URL]. Please run a security-audit on the folder and let me know if it's safe to run the install script."
- "Perform a deep audit on the files in the current directory and list any suspicious obfuscation patterns."
- "Run a security audit on the latest skill I installed from ClawHub and generate a report text file."
Tips & Limitations
- Always Review: This tool is a detection aid, not a guarantee. Even if a scan passes, manually inspect code that interacts with your network or sensitive system files.
- Limitations: The tool is primarily designed for source code analysis and cannot fully execute or emulate complex binaries. It focuses on identifying red flags rather than sandbox detonation. Always use virtual environments when testing foreign code to provide an extra layer of isolation between your system and the external resource.
Metadata
Not sure this is the right skill?
Describe what you want to build — we'll match you to the best skill from 16,000+ options.
Find the right skillPaste this into your clawhub.json to enable this plugin.
{
"plugins": {
"official-ithacajason-jason-security-audit": {
"enabled": true,
"auto_update": true
}
}
}Tags(AI)
Flags: file-read, code-execution