mirror of
https://github.com/UseAI-pro/openclaw-skills-security.git
synced 2026-09-14 18:22:40 +08:00
feat: normalize audit skill metadata schema
This commit is contained in:
developerisnow
+27
-10
@@ -12,17 +12,27 @@ Frontmatter schema (example):
|
||||
```yaml
|
||||
---
|
||||
name: permission-auditor
|
||||
version: 1.0.0
|
||||
description: "Analyze OpenClaw skill permissions and explain security implications."
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 96
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-05"
|
||||
metadata:
|
||||
short-description: Explain requested skill permissions and flag over-privileged combinations.
|
||||
why: Keep skill permissions minimal and understandable before granting access.
|
||||
what: Provides a permission-analysis module for mapping declared access to actual task need.
|
||||
how: Uses permission-by-permission review plus dangerous-combination checks and least-privilege guidance.
|
||||
results: Produces a permission fit assessment with recommended minimal access scope.
|
||||
version: 1.0.0
|
||||
updated: "2026-03-10T00:00:00Z"
|
||||
jtbd-1: When I need to decide whether a skill is requesting more access than its job actually needs.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: "2026-02-05"
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
```
|
||||
|
||||
@@ -44,6 +54,13 @@ This updates:
|
||||
- `README.md` (skills table)
|
||||
- `catalog/skills.md`
|
||||
- `catalog/skills.json`
|
||||
- `catalog/skills.csv`
|
||||
|
||||
Validate the normalized frontmatter contract:
|
||||
|
||||
```bash
|
||||
python3 scripts/validate_skills.py
|
||||
```
|
||||
|
||||
## Reporting malicious skills
|
||||
|
||||
|
||||
@@ -57,6 +57,46 @@ Verdict: **READY / RISKY / NOT_READY**.
|
||||
|
||||
Modules are optional: you usually don't need to install them separately.
|
||||
|
||||
## Metadata contract
|
||||
|
||||
This repo keeps Codex/OpenClaw-compatible frontmatter intentionally small at the top level:
|
||||
|
||||
- `name`
|
||||
- `description`
|
||||
- `metadata.*`
|
||||
|
||||
General skill metadata lives under `metadata.*`, while audit-specific classification lives under `metadata.audit.*`.
|
||||
This keeps the frontmatter compatible with Codex-style loaders while still giving us enough structure for catalog export and review.
|
||||
|
||||
Example:
|
||||
|
||||
```yaml
|
||||
---
|
||||
name: setup-auditor
|
||||
description: Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration.
|
||||
metadata:
|
||||
short-description: Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.
|
||||
why: Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.
|
||||
what: Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence checks.
|
||||
how: Collects operator answers, runs a four-step review, and turns findings into a fix checklist.
|
||||
results: Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.
|
||||
version: 2.0.0
|
||||
updated: '2026-03-10T00:00:00Z'
|
||||
jtbd-1: When I need to know whether my current OpenClaw environment is safe enough to run skills at all.
|
||||
audit:
|
||||
kind: auditor
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: '2026-02-05'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: true
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
```
|
||||
|
||||
## Threat coverage
|
||||
|
||||
Both auditors together cover **12/12 real-world attack types** observed in the wild (including the ClawHavoc campaign):
|
||||
@@ -149,21 +189,21 @@ Treat untrusted skills as **code execution**. Default to sandboxing.
|
||||
|
||||
<!-- catalog:start -->
|
||||
|
||||
| Skill | Type | Category | Trust | Perms | Last audited |
|
||||
| --- | --- | --- | ---: | --- | --- |
|
||||
| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 |
|
||||
| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 |
|
||||
| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 |
|
||||
| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 |
|
||||
| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 |
|
||||
| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 |
|
||||
| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 |
|
||||
| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 |
|
||||
| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 |
|
||||
| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 |
|
||||
| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 |
|
||||
| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 |
|
||||
| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 |
|
||||
| Skill | Type | Category | Trust | Perms | Last audited | Version |
|
||||
| --- | --- | --- | ---: | --- | --- | --- |
|
||||
| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 | 2.0.0 |
|
||||
| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 | 2.0.0 |
|
||||
| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 | 1.0.0 |
|
||||
| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 | 1.0.0 |
|
||||
| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 | 1.0.0 |
|
||||
| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 | 1.0.0 |
|
||||
| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 | 1.0.0 |
|
||||
| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 | 1.0.0 |
|
||||
| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |
|
||||
| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 | 1.0.0 |
|
||||
| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |
|
||||
| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 | 1.0.0 |
|
||||
| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 | 1.0.0 |
|
||||
|
||||
<!-- catalog:end -->
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
name,slug,description,short_description,why,what,how,results,version,updated,jtbd_1,jtbd_2,jtbd_3,audit_kind,audit_author,audit_category,audit_trust_score,audit_last_audited,audit_permission_file_read,audit_permission_file_write,audit_permission_network,audit_permission_shell,path
|
||||
skill-auditor,skill-auditor,"Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything.",Vet any OpenClaw skill before install with a structured six-step security review.,Prevent malicious or over-privileged skills from entering the workspace unchecked.,"Provides a pre-install auditor for skill metadata, permissions, dependencies, prompt injection, and exfiltration risk.",Uses a fixed six-step review protocol with severity-based verdicts and a safe-run plan.,"Produces a SKILL AUDIT REPORT with verdict, red flags, and install guidance.",2.0.0,2026-03-10T03:42:30Z,When I need to decide whether a new skill is safe to install before it touches my environment.,When a skill update changes permissions and I need a repeatable re-vetting workflow.,When I want evidence-based reasons to sandbox or block a skill instead of trusting reputation alone.,auditor,useclawpro,Security,97,2026-02-05,True,False,False,False,skills/skill-auditor/SKILL.md
|
||||
setup-auditor,setup-auditor,"Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist.","Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.",Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.,"Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence checks.","Collects operator answers, runs a four-step review, and turns findings into a fix checklist.","Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.",2.0.0,2026-03-10T03:42:30Z,When I need to know whether my current OpenClaw environment is safe enough to run skills at all.,When I am setting up a new host and want a repeatable readiness checklist instead of ad hoc checks.,When I suspect prior compromise and need to re-audit persistence and exposed credentials quickly.,auditor,useclawpro,Security,96,2026-02-05,True,True,False,False,skills/setup-auditor/SKILL.md
|
||||
credential-scanner,credential-scanner,"Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration.",Scan a workspace for exposed secrets before any skill gets file-read access.,Reduce accidental credential exposure before untrusted or newly added skills can inspect the filesystem.,"Provides a secret-scanning module for common API keys, tokens, and private key patterns in a project.","Uses path-aware regex checks, skip rules, and sanitized reporting instead of printing raw secrets.",Produces a list of exposed-credential findings with masked output and cleanup actions.,1.0.0,2026-03-10T03:42:30Z,When I need a fast preflight to confirm my workspace does not expose secrets to file-reading skills.,,,module,useclawpro,Security,98,2026-02-01,True,False,False,False,skills/credential-scanner/SKILL.md
|
||||
prompt-guard,prompt-guard,"Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation.",Detect prompt injection and instruction hijacking patterns in OpenClaw skill content and inputs.,Prevent hidden instructions from overriding the host agent’s intended behavior.,"Provides a prompt-injection defense module for skill content, user input, and imported text.","Uses pattern detection, normalization, and severity tiers for critical and warning signals.",Produces injection findings and handling guidance before unsafe instructions are trusted.,1.0.0,2026-03-10T03:42:30Z,When I need to check whether a skill or imported content is trying to hijack the agent prompt.,,,module,useclawpro,Security,97,2026-02-03,True,False,False,False,skills/prompt-guard/SKILL.md
|
||||
skill-vetter,skill-vetter,"Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.",Run a legacy deep-vetting checklist before installing an OpenClaw skill from any source.,Preserve a conservative review path for operators who want a manual-first audit flow.,Provides a legacy pre-install security vetting module for skill review and comparison.,"Uses a structured red-flag checklist focused on permissions, patterns, and suspicious instructions.",Produces a conservative manual review output for install-or-block decisions.,1.0.0,2026-03-10T03:42:30Z,When I want a simple manual-first checklist to vet a skill before install.,,,module,useclawpro,Security,97,2026-02-01,True,False,False,False,skills/skill-vetter/SKILL.md
|
||||
incident-responder,incident-responder,"Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected.","Guide containment, investigation, credential rotation, and recovery after a suspected malicious skill.",Shorten response time and reduce damage after a suspicious skill or compromise signal is discovered.,Provides an incident-response module tailored to OpenClaw workspace compromise scenarios.,Uses a step-by-step containment and recovery playbook with explicit operator checkpoints.,"Produces a structured response plan covering containment, evidence, rotation, and recovery.",1.0.0,2026-03-10T03:42:30Z,When I suspect a malicious skill was installed and need an immediate response checklist.,,,module,useclawpro,Security,96,2026-02-03,True,True,False,False,skills/incident-responder/SKILL.md
|
||||
permission-auditor,permission-auditor,Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged skills and suggests minimal permission sets.,Explain requested skill permissions and flag over-privileged combinations.,Keep skill permissions minimal and understandable before granting access.,Provides a permission-analysis module for mapping declared access to actual task need.,Uses permission-by-permission review plus dangerous-combination checks and least-privilege guidance.,Produces a permission fit assessment with recommended minimal access scope.,1.0.0,2026-03-10T03:42:30Z,When I need to decide whether a skill is requesting more access than its job actually needs.,,,module,useclawpro,Security,96,2026-02-01,True,False,False,False,skills/permission-auditor/SKILL.md
|
||||
skill-guard,skill-guard,"Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.",Monitor active OpenClaw skills for runtime behavior that violates declared permissions.,Catch runtime drift between declared permissions and actual behavior before damage spreads.,"Provides a runtime monitoring module for file access, network calls, shell use, and anomalies.",Uses permission-boundary checks and suspicious-behavior signals during active skill execution.,Produces runtime monitoring findings and escalation signals for suspicious behavior.,1.0.0,2026-03-10T03:42:30Z,When I need runtime visibility into whether a running skill is exceeding its declared boundaries.,,,module,useclawpro,Security,96,2026-02-03,True,False,False,False,skills/skill-guard/SKILL.md
|
||||
config-hardener,config-hardener,"Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.","Audit and harden OpenClaw configuration, gateway settings, and permission defaults.",Prevent insecure defaults and weak policy from undermining otherwise safe skill usage.,"Provides a focused module for reviewing AGENTS.md, gateway settings, sandbox config, and permission policy.",Uses a configuration checklist and hardening recommendations tied to concrete OpenClaw surfaces.,Produces configuration findings and a prioritized hardening plan for the current setup.,1.0.0,2026-03-10T03:42:30Z,When I need to harden OpenClaw config before allowing wider skill usage on a host.,,,module,useclawpro,Security,95,2026-02-01,True,True,False,False,skills/config-hardener/SKILL.md
|
||||
network-watcher,network-watcher,"Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections.",Inspect outbound connections and exfiltration patterns requested by OpenClaw skills.,Prevent quiet data exfiltration and unauthorized outbound access hidden behind legitimate-looking network use.,"Provides a network-audit module for reviewing destinations, ports, tunneling patterns, and data egress risk.","Uses endpoint scrutiny, exfiltration heuristics, and explicit safe-pattern checks.","Produces a network risk review with allowed, suspicious, and blocked patterns.",1.0.0,2026-03-10T03:42:30Z,When a skill asks for network access and I need to understand whether that access is justified.,,,module,useclawpro,Security,95,2026-02-03,True,False,False,False,skills/network-watcher/SKILL.md
|
||||
sandbox-guard,sandbox-guard,"Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network, and process access.",Generate safer Docker sandbox profiles for running untrusted OpenClaw skills.,Make sandbox-first execution practical instead of relying on manual container hardening every time.,"Provides a sandbox configuration module for filesystem, network, privilege, and resource isolation.",Uses pre-baked Docker patterns with explicit security flags and usage guidance.,Produces recommended sandbox commands and profiles for read-only or read-write execution.,1.0.0,2026-03-10T03:42:30Z,When I need to run an untrusted skill but want a repeatable isolation profile first.,,,module,useclawpro,Security,95,2026-02-01,True,True,False,False,skills/sandbox-guard/SKILL.md
|
||||
output-sanitizer,output-sanitizer,"Sanitize OpenClaw agent output before display. Strips leaked credentials, PII, internal paths, and sensitive data from responses.","Redact secrets, PII, and internal paths from OpenClaw agent output before display or logging.",Prevent accidental leakage of sensitive material from otherwise useful agent responses.,"Provides a post-processing module for checking output content for secrets, PII, and internal identifiers.",Uses pattern-based detection and masking rules rather than emitting raw sensitive values.,Produces sanitized operator-facing output with sensitive values masked or removed.,1.0.0,2026-03-10T03:42:30Z,When I need to share or log agent output without leaking credentials or personal data.,,,module,useclawpro,Security,94,2026-02-03,True,False,False,False,skills/output-sanitizer/SKILL.md
|
||||
dependency-auditor,dependency-auditor,"Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages.","Audit skill-installed dependencies for typosquatting, hooks, and known package risk.",Catch supply-chain abuse before a skill pulls malicious packages into the environment.,"Provides a dependency review module for npm, pip, and Go install flows used by OpenClaw skills.","Checks package identity, install hooks, recency, reputation, and vulnerability severity.",Produces dependency findings with install recommendations and block conditions.,1.0.0,2026-03-10T03:42:30Z,When a skill wants to install packages and I need a quick supply-chain risk review first.,,,module,useclawpro,Security,93,2026-02-03,True,False,False,False,skills/dependency-auditor/SKILL.md
|
||||
|
+247
-156
@@ -2,235 +2,326 @@
|
||||
{
|
||||
"name": "skill-auditor",
|
||||
"slug": "skill-auditor",
|
||||
"version": "2.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything.",
|
||||
"kind": "auditor",
|
||||
"category": "Security",
|
||||
"trustScore": 97,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-05",
|
||||
"short_description": "Vet any OpenClaw skill before install with a structured six-step security review.",
|
||||
"why": "Prevent malicious or over-privileged skills from entering the workspace unchecked.",
|
||||
"what": "Provides a pre-install auditor for skill metadata, permissions, dependencies, prompt injection, and exfiltration risk.",
|
||||
"how": "Uses a fixed six-step review protocol with severity-based verdicts and a safe-run plan.",
|
||||
"results": "Produces a SKILL AUDIT REPORT with verdict, red flags, and install guidance.",
|
||||
"version": "2.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to decide whether a new skill is safe to install before it touches my environment.",
|
||||
"jtbd_2": "When a skill update changes permissions and I need a repeatable re-vetting workflow.",
|
||||
"jtbd_3": "When I want evidence-based reasons to sandbox or block a skill instead of trusting reputation alone.",
|
||||
"audit_kind": "auditor",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 97,
|
||||
"audit_last_audited": "2026-02-05",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/skill-auditor/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "setup-auditor",
|
||||
"slug": "setup-auditor",
|
||||
"version": "2.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist.",
|
||||
"kind": "auditor",
|
||||
"category": "Security",
|
||||
"trustScore": 96,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": true,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-05",
|
||||
"short_description": "Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.",
|
||||
"why": "Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.",
|
||||
"what": "Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence checks.",
|
||||
"how": "Collects operator answers, runs a four-step review, and turns findings into a fix checklist.",
|
||||
"results": "Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.",
|
||||
"version": "2.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to know whether my current OpenClaw environment is safe enough to run skills at all.",
|
||||
"jtbd_2": "When I am setting up a new host and want a repeatable readiness checklist instead of ad hoc checks.",
|
||||
"jtbd_3": "When I suspect prior compromise and need to re-audit persistence and exposed credentials quickly.",
|
||||
"audit_kind": "auditor",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 96,
|
||||
"audit_last_audited": "2026-02-05",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": true,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/setup-auditor/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "credential-scanner",
|
||||
"slug": "credential-scanner",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 98,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-01",
|
||||
"short_description": "Scan a workspace for exposed secrets before any skill gets file-read access.",
|
||||
"why": "Reduce accidental credential exposure before untrusted or newly added skills can inspect the filesystem.",
|
||||
"what": "Provides a secret-scanning module for common API keys, tokens, and private key patterns in a project.",
|
||||
"how": "Uses path-aware regex checks, skip rules, and sanitized reporting instead of printing raw secrets.",
|
||||
"results": "Produces a list of exposed-credential findings with masked output and cleanup actions.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need a fast preflight to confirm my workspace does not expose secrets to file-reading skills.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 98,
|
||||
"audit_last_audited": "2026-02-01",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/credential-scanner/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "prompt-guard",
|
||||
"slug": "prompt-guard",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 97,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Detect prompt injection and instruction hijacking patterns in OpenClaw skill content and inputs.",
|
||||
"why": "Prevent hidden instructions from overriding the host agent’s intended behavior.",
|
||||
"what": "Provides a prompt-injection defense module for skill content, user input, and imported text.",
|
||||
"how": "Uses pattern detection, normalization, and severity tiers for critical and warning signals.",
|
||||
"results": "Produces injection findings and handling guidance before unsafe instructions are trusted.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to check whether a skill or imported content is trying to hijack the agent prompt.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 97,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/prompt-guard/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "skill-vetter",
|
||||
"slug": "skill-vetter",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 97,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-01",
|
||||
"short_description": "Run a legacy deep-vetting checklist before installing an OpenClaw skill from any source.",
|
||||
"why": "Preserve a conservative review path for operators who want a manual-first audit flow.",
|
||||
"what": "Provides a legacy pre-install security vetting module for skill review and comparison.",
|
||||
"how": "Uses a structured red-flag checklist focused on permissions, patterns, and suspicious instructions.",
|
||||
"results": "Produces a conservative manual review output for install-or-block decisions.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I want a simple manual-first checklist to vet a skill before install.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 97,
|
||||
"audit_last_audited": "2026-02-01",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/skill-vetter/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "incident-responder",
|
||||
"slug": "incident-responder",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 96,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": true,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Guide containment, investigation, credential rotation, and recovery after a suspected malicious skill.",
|
||||
"why": "Shorten response time and reduce damage after a suspicious skill or compromise signal is discovered.",
|
||||
"what": "Provides an incident-response module tailored to OpenClaw workspace compromise scenarios.",
|
||||
"how": "Uses a step-by-step containment and recovery playbook with explicit operator checkpoints.",
|
||||
"results": "Produces a structured response plan covering containment, evidence, rotation, and recovery.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I suspect a malicious skill was installed and need an immediate response checklist.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 96,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": true,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/incident-responder/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "permission-auditor",
|
||||
"slug": "permission-auditor",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged skills and suggests minimal permission sets.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 96,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-01",
|
||||
"short_description": "Explain requested skill permissions and flag over-privileged combinations.",
|
||||
"why": "Keep skill permissions minimal and understandable before granting access.",
|
||||
"what": "Provides a permission-analysis module for mapping declared access to actual task need.",
|
||||
"how": "Uses permission-by-permission review plus dangerous-combination checks and least-privilege guidance.",
|
||||
"results": "Produces a permission fit assessment with recommended minimal access scope.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to decide whether a skill is requesting more access than its job actually needs.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 96,
|
||||
"audit_last_audited": "2026-02-01",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/permission-auditor/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "skill-guard",
|
||||
"slug": "skill-guard",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 96,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Monitor active OpenClaw skills for runtime behavior that violates declared permissions.",
|
||||
"why": "Catch runtime drift between declared permissions and actual behavior before damage spreads.",
|
||||
"what": "Provides a runtime monitoring module for file access, network calls, shell use, and anomalies.",
|
||||
"how": "Uses permission-boundary checks and suspicious-behavior signals during active skill execution.",
|
||||
"results": "Produces runtime monitoring findings and escalation signals for suspicious behavior.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need runtime visibility into whether a running skill is exceeding its declared boundaries.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 96,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/skill-guard/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "config-hardener",
|
||||
"slug": "config-hardener",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 95,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": true,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-01",
|
||||
"short_description": "Audit and harden OpenClaw configuration, gateway settings, and permission defaults.",
|
||||
"why": "Prevent insecure defaults and weak policy from undermining otherwise safe skill usage.",
|
||||
"what": "Provides a focused module for reviewing AGENTS.md, gateway settings, sandbox config, and permission policy.",
|
||||
"how": "Uses a configuration checklist and hardening recommendations tied to concrete OpenClaw surfaces.",
|
||||
"results": "Produces configuration findings and a prioritized hardening plan for the current setup.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to harden OpenClaw config before allowing wider skill usage on a host.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 95,
|
||||
"audit_last_audited": "2026-02-01",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": true,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/config-hardener/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "network-watcher",
|
||||
"slug": "network-watcher",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 95,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Inspect outbound connections and exfiltration patterns requested by OpenClaw skills.",
|
||||
"why": "Prevent quiet data exfiltration and unauthorized outbound access hidden behind legitimate-looking network use.",
|
||||
"what": "Provides a network-audit module for reviewing destinations, ports, tunneling patterns, and data egress risk.",
|
||||
"how": "Uses endpoint scrutiny, exfiltration heuristics, and explicit safe-pattern checks.",
|
||||
"results": "Produces a network risk review with allowed, suspicious, and blocked patterns.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When a skill asks for network access and I need to understand whether that access is justified.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 95,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/network-watcher/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "sandbox-guard",
|
||||
"slug": "sandbox-guard",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network, and process access.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 95,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": true,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-01",
|
||||
"short_description": "Generate safer Docker sandbox profiles for running untrusted OpenClaw skills.",
|
||||
"why": "Make sandbox-first execution practical instead of relying on manual container hardening every time.",
|
||||
"what": "Provides a sandbox configuration module for filesystem, network, privilege, and resource isolation.",
|
||||
"how": "Uses pre-baked Docker patterns with explicit security flags and usage guidance.",
|
||||
"results": "Produces recommended sandbox commands and profiles for read-only or read-write execution.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to run an untrusted skill but want a repeatable isolation profile first.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 95,
|
||||
"audit_last_audited": "2026-02-01",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": true,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/sandbox-guard/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "output-sanitizer",
|
||||
"slug": "output-sanitizer",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Sanitize OpenClaw agent output before display. Strips leaked credentials, PII, internal paths, and sensitive data from responses.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 94,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Redact secrets, PII, and internal paths from OpenClaw agent output before display or logging.",
|
||||
"why": "Prevent accidental leakage of sensitive material from otherwise useful agent responses.",
|
||||
"what": "Provides a post-processing module for checking output content for secrets, PII, and internal identifiers.",
|
||||
"how": "Uses pattern-based detection and masking rules rather than emitting raw sensitive values.",
|
||||
"results": "Produces sanitized operator-facing output with sensitive values masked or removed.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When I need to share or log agent output without leaking credentials or personal data.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 94,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/output-sanitizer/SKILL.md"
|
||||
},
|
||||
{
|
||||
"name": "dependency-auditor",
|
||||
"slug": "dependency-auditor",
|
||||
"version": "1.0.0",
|
||||
"author": "useclawpro",
|
||||
"description": "Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages.",
|
||||
"kind": "module",
|
||||
"category": "Security",
|
||||
"trustScore": 93,
|
||||
"permissions": {
|
||||
"fileRead": true,
|
||||
"fileWrite": false,
|
||||
"network": false,
|
||||
"shell": false
|
||||
},
|
||||
"lastAudited": "2026-02-03",
|
||||
"short_description": "Audit skill-installed dependencies for typosquatting, hooks, and known package risk.",
|
||||
"why": "Catch supply-chain abuse before a skill pulls malicious packages into the environment.",
|
||||
"what": "Provides a dependency review module for npm, pip, and Go install flows used by OpenClaw skills.",
|
||||
"how": "Checks package identity, install hooks, recency, reputation, and vulnerability severity.",
|
||||
"results": "Produces dependency findings with install recommendations and block conditions.",
|
||||
"version": "1.0.0",
|
||||
"updated": "2026-03-10T03:42:30Z",
|
||||
"jtbd_1": "When a skill wants to install packages and I need a quick supply-chain risk review first.",
|
||||
"jtbd_2": "",
|
||||
"jtbd_3": "",
|
||||
"audit_kind": "module",
|
||||
"audit_author": "useclawpro",
|
||||
"audit_category": "Security",
|
||||
"audit_trust_score": 93,
|
||||
"audit_last_audited": "2026-02-03",
|
||||
"audit_permission_file_read": true,
|
||||
"audit_permission_file_write": false,
|
||||
"audit_permission_network": false,
|
||||
"audit_permission_shell": false,
|
||||
"path": "skills/dependency-auditor/SKILL.md"
|
||||
}
|
||||
]
|
||||
|
||||
+15
-15
@@ -1,15 +1,15 @@
|
||||
| Skill | Type | Category | Trust | Perms | Last audited |
|
||||
| --- | --- | --- | ---: | --- | --- |
|
||||
| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 |
|
||||
| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 |
|
||||
| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 |
|
||||
| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 |
|
||||
| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 |
|
||||
| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 |
|
||||
| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 |
|
||||
| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 |
|
||||
| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 |
|
||||
| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 |
|
||||
| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 |
|
||||
| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 |
|
||||
| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 |
|
||||
| Skill | Type | Category | Trust | Perms | Last audited | Version |
|
||||
| --- | --- | --- | ---: | --- | --- | --- |
|
||||
| [skill-auditor](skills/skill-auditor/SKILL.md) | auditor | Security | 97 | R | 2026-02-05 | 2.0.0 |
|
||||
| [setup-auditor](skills/setup-auditor/SKILL.md) | auditor | Security | 96 | R,W | 2026-02-05 | 2.0.0 |
|
||||
| [credential-scanner](skills/credential-scanner/SKILL.md) | module | Security | 98 | R | 2026-02-01 | 1.0.0 |
|
||||
| [prompt-guard](skills/prompt-guard/SKILL.md) | module | Security | 97 | R | 2026-02-03 | 1.0.0 |
|
||||
| [skill-vetter](skills/skill-vetter/SKILL.md) | module | Security | 97 | R | 2026-02-01 | 1.0.0 |
|
||||
| [incident-responder](skills/incident-responder/SKILL.md) | module | Security | 96 | R,W | 2026-02-03 | 1.0.0 |
|
||||
| [permission-auditor](skills/permission-auditor/SKILL.md) | module | Security | 96 | R | 2026-02-01 | 1.0.0 |
|
||||
| [skill-guard](skills/skill-guard/SKILL.md) | module | Security | 96 | R | 2026-02-03 | 1.0.0 |
|
||||
| [config-hardener](skills/config-hardener/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |
|
||||
| [network-watcher](skills/network-watcher/SKILL.md) | module | Security | 95 | R | 2026-02-03 | 1.0.0 |
|
||||
| [sandbox-guard](skills/sandbox-guard/SKILL.md) | module | Security | 95 | R,W | 2026-02-01 | 1.0.0 |
|
||||
| [output-sanitizer](skills/output-sanitizer/SKILL.md) | module | Security | 94 | R | 2026-02-03 | 1.0.0 |
|
||||
| [dependency-auditor](skills/dependency-auditor/SKILL.md) | module | Security | 93 | R | 2026-02-03 | 1.0.0 |
|
||||
|
||||
@@ -1,176 +1,10 @@
|
||||
import { readdirSync, readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
|
||||
import { join } from 'node:path';
|
||||
import { spawnSync } from 'node:child_process';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { dirname, join } from 'node:path';
|
||||
|
||||
const ROOT = process.cwd();
|
||||
const SKILLS_DIR = join(ROOT, 'skills');
|
||||
const CATALOG_DIR = join(ROOT, 'catalog');
|
||||
const README_PATH = join(ROOT, 'README.md');
|
||||
|
||||
function parseFrontmatter(content) {
|
||||
const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
|
||||
if (!match) return null;
|
||||
|
||||
const yaml = match[1];
|
||||
const result = {};
|
||||
|
||||
let currentKey = null;
|
||||
let nestedObj = null;
|
||||
|
||||
for (const line of yaml.split('\n')) {
|
||||
if (!line.trim()) continue;
|
||||
|
||||
if (/^\s{2,}\w/.test(line) && currentKey) {
|
||||
const nestedMatch = line.trim().match(/^(\w+):\s*(.+)$/);
|
||||
if (nestedMatch) {
|
||||
if (!nestedObj) nestedObj = {};
|
||||
let val = nestedMatch[2].trim();
|
||||
if (val === 'true') val = true;
|
||||
else if (val === 'false') val = false;
|
||||
nestedObj[nestedMatch[1]] = val;
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
if (currentKey && nestedObj) {
|
||||
result[currentKey] = nestedObj;
|
||||
nestedObj = null;
|
||||
}
|
||||
|
||||
const topMatch = line.match(/^(\w+):\s*(.*)?$/);
|
||||
if (topMatch) {
|
||||
currentKey = topMatch[1];
|
||||
let val = (topMatch[2] || '').trim();
|
||||
|
||||
if (val === '') {
|
||||
nestedObj = {};
|
||||
continue;
|
||||
}
|
||||
|
||||
if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
|
||||
val = val.slice(1, -1);
|
||||
}
|
||||
|
||||
if (val === 'true') val = true;
|
||||
else if (val === 'false') val = false;
|
||||
else if (/^\d+$/.test(val)) val = parseInt(val, 10);
|
||||
|
||||
result[currentKey] = val;
|
||||
nestedObj = null;
|
||||
}
|
||||
}
|
||||
|
||||
if (currentKey && nestedObj && Object.keys(nestedObj).length > 0) {
|
||||
result[currentKey] = nestedObj;
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
function permsToShort(perms) {
|
||||
const parts = [];
|
||||
if (perms?.fileRead === true) parts.push('R');
|
||||
if (perms?.fileWrite === true) parts.push('W');
|
||||
if (perms?.network === true) parts.push('Net');
|
||||
if (perms?.shell === true) parts.push('Sh');
|
||||
return parts.length ? parts.join(',') : '-';
|
||||
}
|
||||
|
||||
function kindRank(kind) {
|
||||
if (kind === 'auditor') return 0;
|
||||
if (kind === 'module') return 1;
|
||||
return 2;
|
||||
}
|
||||
|
||||
function loadSkills() {
|
||||
if (!existsSync(SKILLS_DIR)) throw new Error(`Missing skills dir: ${SKILLS_DIR}`);
|
||||
|
||||
const dirs = readdirSync(SKILLS_DIR, { withFileTypes: true })
|
||||
.filter(d => d.isDirectory())
|
||||
.map(d => d.name)
|
||||
.sort((a, b) => a.localeCompare(b));
|
||||
|
||||
const skills = [];
|
||||
for (const slug of dirs) {
|
||||
const skillPath = join(SKILLS_DIR, slug, 'SKILL.md');
|
||||
const raw = readFileSync(skillPath, 'utf-8');
|
||||
const fm = parseFrontmatter(raw);
|
||||
if (!fm?.name) continue;
|
||||
|
||||
skills.push({
|
||||
name: fm.name,
|
||||
slug,
|
||||
version: fm.version || '',
|
||||
author: fm.author || '',
|
||||
description: fm.description || '',
|
||||
kind: fm.kind || '',
|
||||
category: fm.category || '',
|
||||
trustScore: typeof fm.trustScore === 'number' ? fm.trustScore : null,
|
||||
permissions: fm.permissions || {},
|
||||
lastAudited: fm.lastAudited || '',
|
||||
path: `skills/${slug}/SKILL.md`,
|
||||
});
|
||||
}
|
||||
|
||||
skills.sort((a, b) => {
|
||||
const ak = kindRank(a.kind);
|
||||
const bk = kindRank(b.kind);
|
||||
if (bk != ak) return ak - bk;
|
||||
const at = a.trustScore ?? -1;
|
||||
const bt = b.trustScore ?? -1;
|
||||
if (bt !== at) return bt - at;
|
||||
return a.slug.localeCompare(b.slug);
|
||||
});
|
||||
|
||||
return skills;
|
||||
}
|
||||
|
||||
function toMarkdownTable(skills) {
|
||||
const header = [
|
||||
'| Skill | Type | Category | Trust | Perms | Last audited |',
|
||||
'| --- | --- | --- | ---: | --- | --- |',
|
||||
];
|
||||
|
||||
const rows = skills.map(s => {
|
||||
const trust = s.trustScore ?? '';
|
||||
const perms = permsToShort(s.permissions);
|
||||
const audited = s.lastAudited || '';
|
||||
const kind = s.kind || '';
|
||||
const category = s.category || '';
|
||||
return `| [${s.slug}](${s.path}) | ${kind} | ${category} | ${trust} | ${perms} | ${audited} |`;
|
||||
});
|
||||
|
||||
return header.concat(rows).join('\n') + '\n';
|
||||
}
|
||||
|
||||
function updateReadmeTable(tableMd) {
|
||||
const readme = readFileSync(README_PATH, 'utf-8');
|
||||
const start = '<!-- catalog:start -->';
|
||||
const end = '<!-- catalog:end -->';
|
||||
|
||||
const startIdx = readme.indexOf(start);
|
||||
const endIdx = readme.indexOf(end);
|
||||
if (startIdx === -1 || endIdx === -1 || endIdx < startIdx) {
|
||||
throw new Error('README.md is missing catalog markers');
|
||||
}
|
||||
|
||||
const before = readme.slice(0, startIdx + start.length);
|
||||
const after = readme.slice(endIdx);
|
||||
const next = `${before}\n\n${tableMd}\n${after}`;
|
||||
|
||||
writeFileSync(README_PATH, next);
|
||||
}
|
||||
|
||||
function main() {
|
||||
const skills = loadSkills();
|
||||
const tableMd = toMarkdownTable(skills);
|
||||
|
||||
mkdirSync(CATALOG_DIR, { recursive: true });
|
||||
writeFileSync(join(CATALOG_DIR, 'skills.md'), tableMd);
|
||||
writeFileSync(join(CATALOG_DIR, 'skills.json'), JSON.stringify(skills, null, 2) + '\n');
|
||||
|
||||
updateReadmeTable(tableMd);
|
||||
|
||||
console.log(`Catalog generated: ${skills.length} skills`);
|
||||
}
|
||||
|
||||
main();
|
||||
const __filename = fileURLToPath(import.meta.url);
|
||||
const __dirname = dirname(__filename);
|
||||
const script = join(__dirname, 'generate_catalog.py');
|
||||
const result = spawnSync('python3', [script], { stdio: 'inherit' });
|
||||
if (result.error) throw result.error;
|
||||
process.exit(result.status ?? 1);
|
||||
|
||||
Executable
+152
@@ -0,0 +1,152 @@
|
||||
#!/usr/bin/env python3
|
||||
from __future__ import annotations
|
||||
|
||||
import csv
|
||||
import json
|
||||
import re
|
||||
from pathlib import Path
|
||||
import sys
|
||||
|
||||
import yaml
|
||||
|
||||
ROOT = Path(__file__).resolve().parent.parent
|
||||
SKILLS_DIR = ROOT / 'skills'
|
||||
CATALOG_DIR = ROOT / 'catalog'
|
||||
README_PATH = ROOT / 'README.md'
|
||||
|
||||
|
||||
def load_frontmatter(path: Path) -> tuple[dict, str]:
|
||||
text = path.read_text(encoding='utf-8')
|
||||
match = re.match(r'^---\r?\n([\s\S]*?)\r?\n---\r?\n?', text)
|
||||
if not match:
|
||||
raise ValueError(f'Missing frontmatter in {path}')
|
||||
frontmatter = yaml.safe_load(match.group(1)) or {}
|
||||
body = text[match.end():]
|
||||
return frontmatter, body
|
||||
|
||||
|
||||
def perms_to_short(perms: dict) -> str:
|
||||
parts = []
|
||||
if perms.get('file-read') is True:
|
||||
parts.append('R')
|
||||
if perms.get('file-write') is True:
|
||||
parts.append('W')
|
||||
if perms.get('network') is True:
|
||||
parts.append('Net')
|
||||
if perms.get('shell') is True:
|
||||
parts.append('Sh')
|
||||
return ','.join(parts) if parts else '-'
|
||||
|
||||
|
||||
def kind_rank(kind: str) -> int:
|
||||
if kind == 'auditor':
|
||||
return 0
|
||||
if kind == 'module':
|
||||
return 1
|
||||
return 2
|
||||
|
||||
|
||||
def flatten_skill(slug: str, path: Path, frontmatter: dict) -> dict:
|
||||
metadata = frontmatter.get('metadata') or {}
|
||||
audit = metadata.get('audit') or {}
|
||||
permissions = audit.get('permissions') or {}
|
||||
return {
|
||||
'name': frontmatter.get('name', ''),
|
||||
'slug': slug,
|
||||
'description': frontmatter.get('description', ''),
|
||||
'short_description': metadata.get('short-description', ''),
|
||||
'why': metadata.get('why', ''),
|
||||
'what': metadata.get('what', ''),
|
||||
'how': metadata.get('how', ''),
|
||||
'results': metadata.get('results', ''),
|
||||
'version': metadata.get('version', ''),
|
||||
'updated': metadata.get('updated', ''),
|
||||
'jtbd_1': metadata.get('jtbd-1', ''),
|
||||
'jtbd_2': metadata.get('jtbd-2', ''),
|
||||
'jtbd_3': metadata.get('jtbd-3', ''),
|
||||
'audit_kind': audit.get('kind', ''),
|
||||
'audit_author': audit.get('author', ''),
|
||||
'audit_category': audit.get('category', ''),
|
||||
'audit_trust_score': audit.get('trust-score', ''),
|
||||
'audit_last_audited': audit.get('last-audited', ''),
|
||||
'audit_permission_file_read': permissions.get('file-read', False),
|
||||
'audit_permission_file_write': permissions.get('file-write', False),
|
||||
'audit_permission_network': permissions.get('network', False),
|
||||
'audit_permission_shell': permissions.get('shell', False),
|
||||
'path': str(path.relative_to(ROOT)),
|
||||
}
|
||||
|
||||
|
||||
def load_skills() -> list[dict]:
|
||||
skills = []
|
||||
for skill_dir in sorted(p for p in SKILLS_DIR.iterdir() if p.is_dir()):
|
||||
skill_path = skill_dir / 'SKILL.md'
|
||||
frontmatter, _ = load_frontmatter(skill_path)
|
||||
if not frontmatter.get('name'):
|
||||
continue
|
||||
skills.append(flatten_skill(skill_dir.name, skill_path, frontmatter))
|
||||
|
||||
skills.sort(
|
||||
key=lambda item: (
|
||||
kind_rank(str(item['audit_kind'])),
|
||||
-(int(item['audit_trust_score']) if str(item['audit_trust_score']).isdigit() else -1),
|
||||
item['slug'],
|
||||
)
|
||||
)
|
||||
return skills
|
||||
|
||||
|
||||
def markdown_table(skills: list[dict]) -> str:
|
||||
header = [
|
||||
'| Skill | Type | Category | Trust | Perms | Last audited | Version |',
|
||||
'| --- | --- | --- | ---: | --- | --- | --- |',
|
||||
]
|
||||
rows = []
|
||||
for item in skills:
|
||||
rows.append(
|
||||
f"| [{item['slug']}]({item['path']}) | {item['audit_kind']} | {item['audit_category']} | {item['audit_trust_score']} | {perms_to_short({'file-read': item['audit_permission_file_read'], 'file-write': item['audit_permission_file_write'], 'network': item['audit_permission_network'], 'shell': item['audit_permission_shell']})} | {item['audit_last_audited']} | {item['version']} |"
|
||||
)
|
||||
return '\n'.join(header + rows) + '\n'
|
||||
|
||||
|
||||
def update_readme(table_md: str) -> None:
|
||||
readme = README_PATH.read_text(encoding='utf-8')
|
||||
start = '<!-- catalog:start -->'
|
||||
end = '<!-- catalog:end -->'
|
||||
start_idx = readme.find(start)
|
||||
end_idx = readme.find(end)
|
||||
if start_idx == -1 or end_idx == -1 or end_idx < start_idx:
|
||||
raise RuntimeError('README.md is missing catalog markers')
|
||||
before = readme[: start_idx + len(start)]
|
||||
after = readme[end_idx:]
|
||||
README_PATH.write_text(f'{before}\n\n{table_md}\n{after}', encoding='utf-8')
|
||||
|
||||
|
||||
def write_csv(skills: list[dict], path: Path) -> None:
|
||||
fieldnames = [
|
||||
'name', 'slug', 'description', 'short_description', 'why', 'what', 'how', 'results',
|
||||
'version', 'updated', 'jtbd_1', 'jtbd_2', 'jtbd_3',
|
||||
'audit_kind', 'audit_author', 'audit_category', 'audit_trust_score', 'audit_last_audited',
|
||||
'audit_permission_file_read', 'audit_permission_file_write', 'audit_permission_network', 'audit_permission_shell',
|
||||
'path',
|
||||
]
|
||||
with path.open('w', encoding='utf-8', newline='') as handle:
|
||||
writer = csv.DictWriter(handle, fieldnames=fieldnames)
|
||||
writer.writeheader()
|
||||
writer.writerows(skills)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
skills = load_skills()
|
||||
CATALOG_DIR.mkdir(parents=True, exist_ok=True)
|
||||
table_md = markdown_table(skills)
|
||||
(CATALOG_DIR / 'skills.md').write_text(table_md, encoding='utf-8')
|
||||
(CATALOG_DIR / 'skills.json').write_text(json.dumps(skills, indent=2, ensure_ascii=False) + '\n', encoding='utf-8')
|
||||
write_csv(skills, CATALOG_DIR / 'skills.csv')
|
||||
update_readme(table_md)
|
||||
print(f'Catalog generated: {len(skills)} skills')
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
raise SystemExit(main())
|
||||
Executable
+107
@@ -0,0 +1,107 @@
|
||||
#!/usr/bin/env python3
|
||||
from __future__ import annotations
|
||||
|
||||
import re
|
||||
from pathlib import Path
|
||||
import sys
|
||||
|
||||
import yaml
|
||||
|
||||
ROOT = Path(__file__).resolve().parent.parent
|
||||
SKILLS_DIR = ROOT / 'skills'
|
||||
REQUIRED_TOP = ['name', 'description', 'metadata']
|
||||
REQUIRED_METADATA = ['short-description', 'why', 'what', 'how', 'results', 'version', 'updated']
|
||||
REQUIRED_AUDIT = ['kind', 'author', 'category', 'trust-score', 'last-audited', 'permissions']
|
||||
REQUIRED_PERMISSIONS = ['file-read', 'file-write', 'network', 'shell']
|
||||
SEMVER_RE = re.compile(r'^\d+\.\d+\.\d+$')
|
||||
UPDATED_RE = re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$')
|
||||
DATE_RE = re.compile(r'^\d{4}-\d{2}-\d{2}$')
|
||||
|
||||
|
||||
def load_frontmatter(path: Path) -> dict:
|
||||
text = path.read_text(encoding='utf-8')
|
||||
match = re.match(r'^---\r?\n([\s\S]*?)\r?\n---\r?\n?', text)
|
||||
if not match:
|
||||
raise ValueError('missing frontmatter block')
|
||||
return yaml.safe_load(match.group(1)) or {}
|
||||
|
||||
|
||||
def validate_skill(path: Path) -> list[str]:
|
||||
errors: list[str] = []
|
||||
try:
|
||||
frontmatter = load_frontmatter(path)
|
||||
except Exception as exc:
|
||||
return [f'{path}: {exc}']
|
||||
|
||||
for key in REQUIRED_TOP:
|
||||
if key not in frontmatter:
|
||||
errors.append(f'{path}: missing top-level {key}')
|
||||
|
||||
metadata = frontmatter.get('metadata') or {}
|
||||
for key in REQUIRED_METADATA:
|
||||
value = metadata.get(key)
|
||||
if value in (None, ''):
|
||||
errors.append(f'{path}: missing metadata.{key}')
|
||||
|
||||
audit = metadata.get('audit') or {}
|
||||
for key in REQUIRED_AUDIT:
|
||||
value = audit.get(key)
|
||||
if value in (None, ''):
|
||||
errors.append(f'{path}: missing metadata.audit.{key}')
|
||||
|
||||
perms = audit.get('permissions') or {}
|
||||
for key in REQUIRED_PERMISSIONS:
|
||||
if key not in perms:
|
||||
errors.append(f'{path}: missing metadata.audit.permissions.{key}')
|
||||
elif not isinstance(perms[key], bool):
|
||||
errors.append(f'{path}: metadata.audit.permissions.{key} must be boolean')
|
||||
|
||||
version = metadata.get('version', '')
|
||||
if version and not SEMVER_RE.match(str(version)):
|
||||
errors.append(f'{path}: metadata.version must be semver')
|
||||
|
||||
updated = metadata.get('updated', '')
|
||||
if updated and not UPDATED_RE.match(str(updated)):
|
||||
errors.append(f'{path}: metadata.updated must be UTC ISO8601 with Z suffix')
|
||||
|
||||
last_audited = audit.get('last-audited', '')
|
||||
if last_audited and not DATE_RE.match(str(last_audited)):
|
||||
errors.append(f'{path}: metadata.audit.last-audited must be YYYY-MM-DD')
|
||||
|
||||
trust_score = audit.get('trust-score')
|
||||
if trust_score is None:
|
||||
pass
|
||||
elif not isinstance(trust_score, int):
|
||||
errors.append(f'{path}: metadata.audit.trust-score must be integer')
|
||||
elif not 0 <= trust_score <= 100:
|
||||
errors.append(f'{path}: metadata.audit.trust-score must be between 0 and 100')
|
||||
|
||||
for key in ['short-description', 'why', 'what', 'how', 'results', 'jtbd-1', 'jtbd-2', 'jtbd-3']:
|
||||
value = metadata.get(key)
|
||||
if value is not None and not isinstance(value, str):
|
||||
errors.append(f'{path}: metadata.{key} must be string when present')
|
||||
|
||||
for key in ['kind', 'author', 'category', 'last-audited']:
|
||||
value = audit.get(key)
|
||||
if value is not None and not isinstance(value, str):
|
||||
errors.append(f'{path}: metadata.audit.{key} must be string')
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
def main() -> int:
|
||||
errors: list[str] = []
|
||||
count = 0
|
||||
for skill_path in sorted(SKILLS_DIR.glob('*/SKILL.md')):
|
||||
count += 1
|
||||
errors.extend(validate_skill(skill_path))
|
||||
if errors:
|
||||
print('\n'.join(errors), file=sys.stderr)
|
||||
print(f'Validation failed: {len(errors)} issue(s) across {count} skill(s)', file=sys.stderr)
|
||||
return 1
|
||||
print(f'Validated {count} skill(s)')
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
raise SystemExit(main())
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: config-hardener
|
||||
version: 1.0.0
|
||||
description: "Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 95
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: true
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-01"
|
||||
description: Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission
|
||||
policies for security weaknesses.
|
||||
metadata:
|
||||
short-description: Audit and harden OpenClaw configuration, gateway settings, and permission defaults.
|
||||
why: Prevent insecure defaults and weak policy from undermining otherwise safe skill usage.
|
||||
what: Provides a focused module for reviewing AGENTS.md, gateway settings, sandbox config, and permission policy.
|
||||
how: Uses a configuration checklist and hardening recommendations tied to concrete OpenClaw surfaces.
|
||||
results: Produces configuration findings and a prioritized hardening plan for the current setup.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to harden OpenClaw config before allowing wider skill usage on a host.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 95
|
||||
last-audited: '2026-02-01'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: true
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Config Hardener
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: credential-scanner
|
||||
version: 1.0.0
|
||||
description: "Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 98
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-01"
|
||||
description: Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental
|
||||
exfiltration.
|
||||
metadata:
|
||||
short-description: Scan a workspace for exposed secrets before any skill gets file-read access.
|
||||
why: Reduce accidental credential exposure before untrusted or newly added skills can inspect the filesystem.
|
||||
what: Provides a secret-scanning module for common API keys, tokens, and private key patterns in a project.
|
||||
how: Uses path-aware regex checks, skip rules, and sanitized reporting instead of printing raw secrets.
|
||||
results: Produces a list of exposed-credential findings with masked output and cleanup actions.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need a fast preflight to confirm my workspace does not expose secrets to file-reading skills.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 98
|
||||
last-audited: '2026-02-01'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Credential Scanner
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: dependency-auditor
|
||||
version: 1.0.0
|
||||
description: "Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting, and malicious packages."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 93
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Audit npm, pip, and Go dependencies that OpenClaw skills try to install. Checks for known vulnerabilities, typosquatting,
|
||||
and malicious packages.
|
||||
metadata:
|
||||
short-description: Audit skill-installed dependencies for typosquatting, hooks, and known package risk.
|
||||
why: Catch supply-chain abuse before a skill pulls malicious packages into the environment.
|
||||
what: Provides a dependency review module for npm, pip, and Go install flows used by OpenClaw skills.
|
||||
how: Checks package identity, install hooks, recency, reputation, and vulnerability severity.
|
||||
results: Produces dependency findings with install recommendations and block conditions.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When a skill wants to install packages and I need a quick supply-chain risk review first.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 93
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Dependency Auditor
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: incident-responder
|
||||
version: 1.0.0
|
||||
description: "Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 96
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: true
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation,
|
||||
credential rotation, and recovery after a malicious skill is detected.
|
||||
metadata:
|
||||
short-description: Guide containment, investigation, credential rotation, and recovery after a suspected malicious skill.
|
||||
why: Shorten response time and reduce damage after a suspicious skill or compromise signal is discovered.
|
||||
what: Provides an incident-response module tailored to OpenClaw workspace compromise scenarios.
|
||||
how: Uses a step-by-step containment and recovery playbook with explicit operator checkpoints.
|
||||
results: Produces a structured response plan covering containment, evidence, rotation, and recovery.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I suspect a malicious skill was installed and need an immediate response checklist.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: true
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Incident Responder
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: network-watcher
|
||||
version: 1.0.0
|
||||
description: "Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 95
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls,
|
||||
and suspicious outbound connections.
|
||||
metadata:
|
||||
short-description: Inspect outbound connections and exfiltration patterns requested by OpenClaw skills.
|
||||
why: Prevent quiet data exfiltration and unauthorized outbound access hidden behind legitimate-looking network use.
|
||||
what: Provides a network-audit module for reviewing destinations, ports, tunneling patterns, and data egress risk.
|
||||
how: Uses endpoint scrutiny, exfiltration heuristics, and explicit safe-pattern checks.
|
||||
results: Produces a network risk review with allowed, suspicious, and blocked patterns.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When a skill asks for network access and I need to understand whether that access is justified.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 95
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Network Watcher
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: output-sanitizer
|
||||
version: 1.0.0
|
||||
description: "Sanitize OpenClaw agent output before display. Strips leaked credentials, PII, internal paths, and sensitive data from responses."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 94
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Sanitize OpenClaw agent output before display. Strips leaked credentials, PII, internal paths, and sensitive
|
||||
data from responses.
|
||||
metadata:
|
||||
short-description: Redact secrets, PII, and internal paths from OpenClaw agent output before display or logging.
|
||||
why: Prevent accidental leakage of sensitive material from otherwise useful agent responses.
|
||||
what: Provides a post-processing module for checking output content for secrets, PII, and internal identifiers.
|
||||
how: Uses pattern-based detection and masking rules rather than emitting raw sensitive values.
|
||||
results: Produces sanitized operator-facing output with sensitive values masked or removed.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to share or log agent output without leaking credentials or personal data.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 94
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Output Sanitizer
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: permission-auditor
|
||||
version: 1.0.0
|
||||
description: "Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged skills and suggests minimal permission sets."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 96
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-01"
|
||||
description: Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged
|
||||
skills and suggests minimal permission sets.
|
||||
metadata:
|
||||
short-description: Explain requested skill permissions and flag over-privileged combinations.
|
||||
why: Keep skill permissions minimal and understandable before granting access.
|
||||
what: Provides a permission-analysis module for mapping declared access to actual task need.
|
||||
how: Uses permission-by-permission review plus dangerous-combination checks and least-privilege guidance.
|
||||
results: Produces a permission fit assessment with recommended minimal access scope.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to decide whether a skill is requesting more access than its job actually needs.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: '2026-02-01'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Permission Auditor
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: prompt-guard
|
||||
version: 1.0.0
|
||||
description: "Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 97
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources.
|
||||
Prevents instruction hijacking and context manipulation.
|
||||
metadata:
|
||||
short-description: Detect prompt injection and instruction hijacking patterns in OpenClaw skill content and inputs.
|
||||
why: Prevent hidden instructions from overriding the host agent’s intended behavior.
|
||||
what: Provides a prompt-injection defense module for skill content, user input, and imported text.
|
||||
how: Uses pattern detection, normalization, and severity tiers for critical and warning signals.
|
||||
results: Produces injection findings and handling guidance before unsafe instructions are trusted.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to check whether a skill or imported content is trying to hijack the agent prompt.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 97
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Prompt Guard
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: sandbox-guard
|
||||
version: 1.0.0
|
||||
description: "Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network, and process access."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 95
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: true
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-01"
|
||||
description: Generate Docker sandbox configurations for safely running untrusted OpenClaw skills. Isolates filesystem, network,
|
||||
and process access.
|
||||
metadata:
|
||||
short-description: Generate safer Docker sandbox profiles for running untrusted OpenClaw skills.
|
||||
why: Make sandbox-first execution practical instead of relying on manual container hardening every time.
|
||||
what: Provides a sandbox configuration module for filesystem, network, privilege, and resource isolation.
|
||||
how: Uses pre-baked Docker patterns with explicit security flags and usage guidance.
|
||||
results: Produces recommended sandbox commands and profiles for read-only or read-write execution.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to run an untrusted skill but want a repeatable isolation profile first.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 95
|
||||
last-audited: '2026-02-01'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: true
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Sandbox Guard
|
||||
|
||||
@@ -1,17 +1,30 @@
|
||||
---
|
||||
name: setup-auditor
|
||||
version: 2.0.0
|
||||
description: "Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist."
|
||||
kind: auditor
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 96
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: true
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-05"
|
||||
description: 'Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style:
|
||||
answers questions about your setup and produces a fix checklist.'
|
||||
metadata:
|
||||
short-description: Audit an OpenClaw environment for exposed secrets, unsafe defaults, and missing sandbox controls.
|
||||
why: Reduce the chance that an otherwise legitimate skill can read secrets or run in an unsafe host setup.
|
||||
what: Provides a wizard-style environment audit covering credentials, config hardening, sandbox readiness, and persistence
|
||||
checks.
|
||||
how: Collects operator answers, runs a four-step review, and turns findings into a fix checklist.
|
||||
results: Produces a SETUP AUDIT REPORT with readiness verdict, findings, and concrete remediation steps.
|
||||
version: 2.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to know whether my current OpenClaw environment is safe enough to run skills at all.
|
||||
jtbd-2: When I am setting up a new host and want a repeatable readiness checklist instead of ad hoc checks.
|
||||
jtbd-3: When I suspect prior compromise and need to re-audit persistence and exposed credentials quickly.
|
||||
audit:
|
||||
kind: auditor
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: '2026-02-05'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: true
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Setup Auditor
|
||||
|
||||
@@ -1,17 +1,29 @@
|
||||
---
|
||||
name: skill-auditor
|
||||
version: 2.0.0
|
||||
description: "Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything."
|
||||
kind: auditor
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 97
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-05"
|
||||
description: Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection,
|
||||
supply chain risks, and data exfiltration patterns — before you install anything.
|
||||
metadata:
|
||||
short-description: Vet any OpenClaw skill before install with a structured six-step security review.
|
||||
why: Prevent malicious or over-privileged skills from entering the workspace unchecked.
|
||||
what: Provides a pre-install auditor for skill metadata, permissions, dependencies, prompt injection, and exfiltration risk.
|
||||
how: Uses a fixed six-step review protocol with severity-based verdicts and a safe-run plan.
|
||||
results: Produces a SKILL AUDIT REPORT with verdict, red flags, and install guidance.
|
||||
version: 2.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need to decide whether a new skill is safe to install before it touches my environment.
|
||||
jtbd-2: When a skill update changes permissions and I need a repeatable re-vetting workflow.
|
||||
jtbd-3: When I want evidence-based reasons to sandbox or block a skill instead of trusting reputation alone.
|
||||
audit:
|
||||
kind: auditor
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 97
|
||||
last-audited: '2026-02-05'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Skill Auditor
|
||||
|
||||
+22
-12
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: skill-guard
|
||||
version: 1.0.0
|
||||
description: "Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 96
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-03"
|
||||
description: Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands.
|
||||
Flags anomalous behavior and enforces permission boundaries.
|
||||
metadata:
|
||||
short-description: Monitor active OpenClaw skills for runtime behavior that violates declared permissions.
|
||||
why: Catch runtime drift between declared permissions and actual behavior before damage spreads.
|
||||
what: Provides a runtime monitoring module for file access, network calls, shell use, and anomalies.
|
||||
how: Uses permission-boundary checks and suspicious-behavior signals during active skill execution.
|
||||
results: Produces runtime monitoring findings and escalation signals for suspicious behavior.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I need runtime visibility into whether a running skill is exceeding its declared boundaries.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 96
|
||||
last-audited: '2026-02-03'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Skill Guard
|
||||
|
||||
@@ -1,17 +1,27 @@
|
||||
---
|
||||
name: skill-vetter
|
||||
version: 1.0.0
|
||||
description: "Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns."
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trustScore: 97
|
||||
permissions:
|
||||
fileRead: true
|
||||
fileWrite: false
|
||||
network: false
|
||||
shell: false
|
||||
lastAudited: "2026-02-01"
|
||||
description: Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources.
|
||||
Checks for red flags, permission scope, and suspicious patterns.
|
||||
metadata:
|
||||
short-description: Run a legacy deep-vetting checklist before installing an OpenClaw skill from any source.
|
||||
why: Preserve a conservative review path for operators who want a manual-first audit flow.
|
||||
what: Provides a legacy pre-install security vetting module for skill review and comparison.
|
||||
how: Uses a structured red-flag checklist focused on permissions, patterns, and suspicious instructions.
|
||||
results: Produces a conservative manual review output for install-or-block decisions.
|
||||
version: 1.0.0
|
||||
updated: '2026-03-10T03:42:30Z'
|
||||
jtbd-1: When I want a simple manual-first checklist to vet a skill before install.
|
||||
audit:
|
||||
kind: module
|
||||
author: useclawpro
|
||||
category: Security
|
||||
trust-score: 97
|
||||
last-audited: '2026-02-01'
|
||||
permissions:
|
||||
file-read: true
|
||||
file-write: false
|
||||
network: false
|
||||
shell: false
|
||||
---
|
||||
|
||||
# Skill Vetter
|
||||
|
||||
Reference in New Issue
Block a user