Skills Security

The Skills Security audit is part of the Security Audit scan phase. It scans all OpenClaw skills directories for supply chain risks, prompt injection patterns, suspicious hook code, and file integrity drift.

What it checks

The scanner runs 7 checks across 4 layers for every skill in ~/.openclaw/skills/ and any extra directories configured in openclaw.json:

1. Install commands

Checks the install: block of each SKILL.md for dangerous shell execution patterns:

• curl, wget, eval, exec, bash -c, base64, piped sh/bash

Skills should not need to run shell commands during installation.

2. Secret injection

Detects skills that inject secrets via frontmatter:

• apiKey:, secret:, token: fields
• env: blocks referencing KEY, SECRET, TOKEN, or PASSWORD

Secrets injected via skills run in the host process context and can be exfiltrated by malicious skill instructions.

3. Data exfiltration

Scans skill body content for network commands paired with external URLs:

• curl, wget, nc, ncat combined with https:// or IP addresses

4. Prompt injection (7 sub-checks)

Skills are Markdown documents injected into the system prompt. A malicious skill can instruct the agent without any executable code:

5. Hook security

Skills can ship handler.js or handler.ts companion files that execute as real code. The scanner checks for:

• Reverse shells — spawn, exec, child_process with /bin/sh
• External HTTP — fetch, axios, http.request to non-localhost URLs
• Sensitive file reads — readFile/readFileSync accessing SSH, .env, credentials
• Environment dumping — unqualified process.env access or JSON stringification
• Dynamic execution — eval(), new Function(), vm.runInNewContext

6. File integrity

SHA-256 hash tracking for every SKILL.md file:

• First scan: records baseline hashes in ~/.clawkeeper/skills-hashes.json
• Subsequent scans: detects modifications by comparing against stored hashes
• Any change (even whitespace) triggers a FAIL

7. Config audit

Checks openclaw.json for supply chain risks:

• Plaintext secrets in skills.entries (API keys, passwords)
• World/group-writable extra skill directories (attackers can plant malicious skills)

First-party skills

Skills authored by Clawkeeper (e.g., runtime-shield) are automatically whitelisted from supply-chain checks 1–5. File integrity hashing (check 6) still runs to detect tampering. The whitelist is based on the author: Clawkeeper field in the SKILL.md frontmatter.

Remediation

When the scanner detects a dangerous skill, it offers interactive remediation:

• Quarantine — renames SKILL.md to SKILL.md.quarantined, preventing OpenClaw from loading it
• Permission fix — sets skills directory permissions to 700

You can also manually review and remove suspicious skills:

# List installed skills
ls ~/.openclaw/skills/

# Quarantine a suspicious skill
mv ~/.openclaw/skills/suspect-skill/SKILL.md ~/.openclaw/skills/suspect-skill/SKILL.md.quarantined

# Remove entirely
rm -rf ~/.openclaw/skills/suspect-skill/

Dashboard insights

The skills scanner generates two insight types on the dashboard (Pro+):

Skill Marketplace

The dashboard includes a built-in Skill Marketplace (Pro+) that lets you browse and install from ClawHub's catalog of 13,000+ community skills. Each skill displays a security badge based on ClawHub's automated scanning:

Skills are cached locally and synced from ClawHub every 6 hours. You can search by name, filter by security status, and install directly from the dashboard without SSH access.

Tips

• Only install skills from trusted sources (official ClawHub, verified authors)
• Check the security badge before installing — prefer skills marked as "Clean"
• Review SKILL.md content before installing — look for base64 blocks, override language, or unusual instructions
• Check hook files (handler.js) for network calls or sensitive file access
• Re-run the scanner after installing new skills to record baseline hashes
• Use clawkeeper.sh scan --phase security_audit to run just the security audit phase