ecap-security-auditor

What This Skill Does

The ecap-security-auditor is a mission-critical security layer designed to transform your OpenClaw AI agent into a proactive defender. It provides a robust framework for auditing AI agent skills, MCP (Model Context Protocol) servers, and third-party packages before they execute on your system. By integrating with a shared trust database and running local integrity checks, this skill prevents malicious code execution, protects against dependency tampering, and provides granular visibility into the risk profile of every installation.

Installation

To integrate this security shield into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/starbuck100/ecap-security-auditor Once installed, the agent will automatically begin monitoring your package and skill installation workflows.

Use Cases

This skill is indispensable for developers and power users who frequently pull external packages or community-contributed skills. It serves as a mandatory gatekeeper during automated installations, ensuring that any code entering your environment has been vetted against known vulnerabilities. Use it to conduct security post-mortems on existing environment configurations, or verify the integrity of an MCP server before allowing it to access your local files or network.

Example Prompts

1. "ecap-security-auditor, please audit the package 'node-fetch' before I proceed with the installation."
2. "Run a security verification on the latest MCP server I added and show me the current trust score."
3. "Check if any of my currently installed skills have known security findings or if the hashes have been altered."

Tips & Limitations

• Gate Flow: Always pay attention to the score thresholds. Scores below 40 result in a hard block; treat these as high-risk alerts.
• Regular Audits: Even for trusted packages, perform periodic audits to catch potential supply-chain compromises using the audit command.
• Limitations: The tool relies on the trust registry and local hash verification. If a malicious actor has introduced a zero-day vulnerability not yet in the registry, the tool may still show a 'PASS' status. Always exercise due diligence when installing obscure or unverified packages.