[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CKFSCWWPMSDZXHG004N25H":3,"skill-same:01M6CKFSCWWPMSDZXHG004N25H":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M6CKFSCWWPMSDZXHG004N25H","skill-security-auditor",null,"Pre-installation security auditor for ClawHub skills. Analyzes SKILL.md files, dependencies, and code for malicious patterns, credential leaks, suspicious prerequisites, and C2 infrastructure indicators before installation.","kbarbel640-del\u002Fskills","kbarbel640-del","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F255315490?v=4","01M6CJPPQGCCESXMG3K7BBGQ5J","01M6CJPPX2PB2BCZERFVM2C2B3",1,"MIT","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"security","skill security auditor","security auditor","indicators","patterns","credential","files","jq","curl","grep","malware-detection","malicious","detection","c2","malware","audit","code","infrastructure","clawhub","suspicious","2026-11-10 10:12:30",false,"---\nname: skill-security-auditor\ndescription: Pre-installation security auditor for ClawHub skills. Analyzes SKILL.md files, dependencies, and code for malicious patterns, credential leaks, suspicious prerequisites, and C2 infrastructure indicators before installation.\nemoji: ??️\nmetadata:\n  openclaw:\n    requires:\n      bins: [\"curl\", \"jq\", \"grep\"]\n    version: \"1.0.0\"\n    author: \"akm626\"\n    category: \"security\"\n    tags: [\"security\", \"audit\", \"malware-detection\", \"skill-vetting\"]\n---\n\n# Skill Security Auditor\n\n## Description\n\nThe Skill Security Auditor is a defensive cybersecurity tool designed to protect OpenClaw users from malicious ClawHub skills. Given the recent discovery of 341+ malicious skills (ClawHavoc campaign) that distributed Atomic Stealer (AMOS) and stole cryptocurrency credentials, this skill provides **pre-installation security analysis** of skills before they're added to your workspace.\n\n**Use this skill when:**\n- About to install a new skill from ClawHub\n- Investigating suspicious skill behavior\n- Performing security due diligence on community skills\n- Auditing your currently installed skills\n- User requests security vetting of a skill\n\n**This skill does NOT replace:**\n- VirusTotal scanning (complementary)\n- Manual code review (recommended for critical use)\n- Your own security judgment\n\n## Core Capabilities\n\n### 1. **Malicious Pattern Detection**\nScans for known malicious patterns from the ClawHavoc campaign:\n- Fake prerequisite installations (openclaw-agent.zip, openclaw-setup.exe)\n- Suspicious download commands in SKILL.md\n- Hidden payload execution in metadata\n- Social engineering language patterns\n- Unauthorized external binary downloads\n\n### 2. **Credential Leak Analysis**\nIdentifies potential credential exposure vectors:\n- Hardcoded API keys, tokens, passwords in SKILL.md\n- Suspicious environment variable exfiltration\n- Unencrypted sensitive data transmission\n- Overly broad permission requests\n- Credential harvesting patterns\n\n### 3. **Dependency Chain Validation**\nAnalyzes skill dependencies for:\n- Unverified binary requirements\n- Suspicious GitHub repository sources\n- External script execution\n- Network connections to unknown hosts\n- Nested dependency exploitation\n\n### 4. **C2 Infrastructure Detection**\nChecks for Command & Control indicators:\n- Known malicious IP addresses (e.g., 91.92.242.30 from ClawHavoc)\n- Suspicious domain patterns\n- Encoded communication endpoints\n- Data exfiltration channels\n- Beaconing behavior patterns\n\n### 5. **SKILL.md Structure Validation**\nVerifies skill integrity:\n- Proper YAML frontmatter structure\n- Metadata consistency\n- Description clarity vs actual behavior\n- Permission justification\n- Author verification (GitHub account age)\n\n## Security Scoring System\n\nEach analyzed skill receives a **Risk Score (0-100)**:\n\n- **0-20**: ✅ **SAFE** - No significant security concerns\n- **21-40**: ⚠️ **LOW RISK** - Minor concerns, proceed with caution\n- **41-60**: ? **MEDIUM RISK** - Multiple red flags, manual review recommended\n- **61-80**: ? **HIGH RISK** - Serious concerns, do NOT install without expert review\n- **81-100**: ☠️ **CRITICAL** - Malicious indicators detected, AVOID installation\n\n## Usage Instructions\n\n### Audit a Skill from ClawHub\n\nWhen the user wants to install a skill, **ALWAYS run this audit first**:\n\n```bash\n# Fetch the skill from ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Flatest\" > \u002Ftmp\u002Fskill-audit.json\n\n# Extract SKILL.md content\njq -r '.content' \u002Ftmp\u002Fskill-audit.json > \u002Ftmp\u002Fskill.md\n\n# Run security analysis\nopenclaw analyze-skill \u002Ftmp\u002Fskill.md\n```\n\n### Audit Local Installed Skills\n\n```bash\n# Audit all skills in workspace\nfor skill in ~\u002F.openclaw\u002Fskills\u002F*\u002FSKILL.md; do\n  echo \"Auditing: $(basename $(dirname $skill))\"\n  openclaw analyze-skill \"$skill\"\ndone\n```\n\n### Quick Security Check\n\n```bash\n# Fast malicious pattern scan\ngrep -E \"(openclaw-agent\\.zip|openclaw-setup\\.exe|91\\.92\\.242\\.30)\" \u002Ftmp\u002Fskill.md\n```\n\n## Detection Heuristics\n\n### ? CRITICAL Red Flags (Auto-fail)\n\n1. **Fake Prerequisites Section**\n   - Matches: \"Prerequisites\", \"Setup Required\", \"Installation Steps\"\n   - Contains: Download links to `.zip`, `.exe`, `.dmg` files\n   - Example: \"Download openclaw-agent.zip from https:\u002F\u002F...\"\n\n2. **Known Malicious Infrastructure**\n   - IP: `91.92.242.30` (ClawHavoc C2)\n   - Domains: Newly registered or suspicious TLDs\n   - Encoded URLs or base64 obfuscation\n\n3. **Credential Harvesting**\n   - Regex patterns for API keys: `(api[_-]?key|token|password)\\s*[:=]\\s*['\\\"][^'\\\"]+['\\\"]`\n   - SSH key access requests\n   - Wallet private key patterns\n\n4. **Unauthorized Code Execution**\n   - `curl | bash` or `wget | sh` patterns\n   - Hidden base64 encoded commands\n   - Dynamic eval() or exec() on external input\n\n### ⚠️ Warning Indicators (Score increase)\n\n1. **Suspicious Dependencies**\n   - Binary requirements without clear justification\n   - Dependencies from unverified sources\n   - Excessive permission requests\n\n2. **Obfuscation Techniques**\n   - Heavily encoded strings in metadata\n   - Minified or obfuscated JavaScript\u002FPython\n   - Redirect chains in URLs\n\n3. **Social Engineering Language**\n   - Urgency phrases: \"Install immediately\", \"Limited time\"\n   - Authority claims: \"Official OpenClaw\", \"Verified by Anthropic\"\n   - Fear tactics: \"Your system is at risk without this\"\n\n### ✅ Positive Security Indicators\n\n1. **Verified Author**\n   - GitHub account > 1 year old\n   - Multiple well-rated skills\n   - Active community engagement\n\n2. **Transparent Dependencies**\n   - Clear binary requirements with official sources\n   - Open-source tool dependencies\n   - Well-documented permission needs\n\n3. **Code Quality**\n   - Clean, readable SKILL.md\n   - Proper error handling\n   - No unnecessary network calls\n\n## Audit Report Format\n\n```markdown\n## Security Audit Report\n**Skill**: {skill-name}\n**Author**: {author}\n**Version**: {version}\n**Audit Date**: {date}\n\n### Risk Score: {score}\u002F100 - {RISK_LEVEL}\n\n### Critical Findings:\n- {finding 1}\n- {finding 2}\n\n### Warning Indicators:\n- {warning 1}\n- {warning 2}\n\n### Positive Indicators:\n- {positive 1}\n- {positive 2}\n\n### Recommendations:\n{INSTALL | DO NOT INSTALL | REVIEW MANUALLY}\n\n### Detailed Analysis:\n{Deep dive into specific concerns}\n\n### VirusTotal Link:\n{If available from ClawHub}\n```\n\n## Integration with VirusTotal\n\nIf the skill has been scanned by VirusTotal (OpenClaw's new partnership):\n\n```bash\n# Check VirusTotal report via ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Fvirustotal\" | jq\n```\n\nAlways recommend users check both this audit AND VirusTotal before installation.\n\n## Example Workflow\n\n**User**: \"I want to install the solana-wallet-tracker skill\"\n\n**OpenClaw with Security Auditor**:\n\n1. ✋ \"Hold on, let me run a security audit first...\"\n2. ? Fetches skill from ClawHub\n3. ?️ Runs malicious pattern detection\n4. ? Generates risk score and report\n5. ⚠️ **Alert**: \"HIGH RISK DETECTED - This skill contains fake prerequisites requesting download of 'openclaw-agent.zip' from an untrusted source. This matches the ClawHavoc malware campaign pattern. DO NOT INSTALL.\"\n6. ? Provides VirusTotal link for cross-reference\n7. ✅ Suggests safe alternative skills if available\n\n## Advanced Features\n\n### 1. Behavioral Analysis (Future Enhancement)\n- Sandbox execution monitoring\n- Network traffic analysis\n- File system access patterns\n\n### 2. Community Threat Intelligence\n- Share malicious skill signatures\n- Collaborative IOC database\n- Reputation scoring system\n\n### 3. Continuous Monitoring\n- Auto-audit skills on updates\n- Alert on new security advisories\n- Periodic re-scanning of installed skills\n\n## False Positive Mitigation\n\nTo minimize false positives:\n\n1. **Contextual Analysis**: Binary requirements for legitimate tools (e.g., `gh` for GitHub CLI) are validated against known safe sources\n2. **Whitelisting**: Verified authors and established skills get trust bonuses\n3. **Human Review Option**: Always provide detailed reasoning for security decisions\n4. **Appeal Process**: Users can report false positives for skill reputation adjustment\n\n## Compliance & Ethics\n\nThis skill:\n- ✅ Analyzes publicly available skill metadata\n- ✅ Protects user security and privacy\n- ✅ Promotes responsible skill development\n- ❌ Does NOT perform unauthorized access\n- ❌ Does NOT guarantee 100% security (nothing does)\n- ❌ Does NOT replace user judgment\n\n## Response Templates\n\n### Safe Skill\n```\n✅ Security Audit Complete\n\n{skill-name} has been analyzed and appears SAFE to install.\n\nRisk Score: {score}\u002F100 (LOW)\n\nNo malicious patterns detected. The skill:\n- Uses standard dependencies from trusted sources\n- Has a verified author with {X} published skills\n- Contains clear documentation with no obfuscation\n- Requests appropriate permissions for its function\n\nVirusTotal: {link}\n\nRecommendation: Safe to proceed with installation.\n```\n\n### Suspicious Skill\n```\n? Security Alert: HIGH RISK DETECTED\n\n{skill-name} has been flagged with CRITICAL security concerns.\n\nRisk Score: {score}\u002F100 (HIGH)\n\n⚠️ Critical Findings:\n{detailed findings}\n\nThis skill matches patterns from the ClawHavoc malware campaign.\n\nRecommendation: DO NOT INSTALL. Consider reporting this skill to ClawHub moderators.\n\nAlternative safe skills: {suggestions}\n```\n\n## Technical Implementation Notes\n\n**Pattern Database Location**: `~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002F`\n- `malicious-patterns.json`: Known bad indicators\n- `safe-patterns.json`: Whitelisted elements\n- `ioc-database.json`: Indicators of Compromise\n\n**Update Mechanism**:\n```bash\n# Pull latest threat intelligence\ncurl -s \"https:\u002F\u002Fopenclaw-security.github.io\u002Fthreat-intel\u002Flatest.json\" \\\n  > ~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002Fioc-database.json\n```\n\n## Contributing\n\nFound a new malicious pattern? Submit IOCs to the OpenClaw Security Working Group:\n- GitHub: github.com\u002Fopenclaw\u002Fsecurity-auditor\n- Report Format: JSON with pattern regex, description, severity\n\n## Limitations\n\n⚠️ **Important Disclaimers**:\n- This tool provides analysis, not guarantees\n- Sophisticated malware may evade detection\n- Always combine with VirusTotal + manual review for critical applications\n- Security is a shared responsibility\n- No automated tool replaces security expertise\n\n## References\n\n- ClawHavoc Campaign Analysis: [The Hacker News, Feb 2026]\n- OpenClaw Security Partnership: VirusTotal Integration\n- Malicious Skill Database: OpenSourceMalware Research\n- ClawHub Moderation Guide: docs.openclaw.ai\u002Fsecurity\n\n---\n\n**Remember**: The best security is defense in depth. Use this skill as ONE layer of your security strategy, not the only layer.\n\nStay safe, stay skeptical, stay secure. ??️\n","# Skill Security Auditor\n\n## Description\n\nThe Skill Security Auditor is a defensive cybersecurity tool designed to protect OpenClaw users from malicious ClawHub skills. Given the recent discovery of 341+ malicious skills (ClawHavoc campaign) that distributed Atomic Stealer (AMOS) and stole cryptocurrency credentials, this skill provides **pre-installation security analysis** of skills before they're added to your workspace.\n\n**Use this skill when:**\n- About to install a new skill from ClawHub\n- Investigating suspicious skill behavior\n- Performing security due diligence on community skills\n- Auditing your currently installed skills\n- User requests security vetting of a skill\n\n**This skill does NOT replace:**\n- VirusTotal scanning (complementary)\n- Manual code review (recommended for critical use)\n- Your own security judgment\n\n## Core Capabilities\n\n### 1. **Malicious Pattern Detection**\nScans for known malicious patterns from the ClawHavoc campaign:\n- Fake prerequisite installations (openclaw-agent.zip, openclaw-setup.exe)\n- Suspicious download commands in SKILL.md\n- Hidden payload execution in metadata\n- Social engineering language patterns\n- Unauthorized external binary downloads\n\n### 2. **Credential Leak Analysis**\nIdentifies potential credential exposure vectors:\n- Hardcoded API keys, tokens, passwords in SKILL.md\n- Suspicious environment variable exfiltration\n- Unencrypted sensitive data transmission\n- Overly broad permission requests\n- Credential harvesting patterns\n\n### 3. **Dependency Chain Validation**\nAnalyzes skill dependencies for:\n- Unverified binary requirements\n- Suspicious GitHub repository sources\n- External script execution\n- Network connections to unknown hosts\n- Nested dependency exploitation\n\n### 4. **C2 Infrastructure Detection**\nChecks for Command & Control indicators:\n- Known malicious IP addresses (e.g., 91.92.242.30 from ClawHavoc)\n- Suspicious domain patterns\n- Encoded communication endpoints\n- Data exfiltration channels\n- Beaconing behavior patterns\n\n### 5. **SKILL.md Structure Validation**\nVerifies skill integrity:\n- Proper YAML frontmatter structure\n- Metadata consistency\n- Description clarity vs actual behavior\n- Permission justification\n- Author verification (GitHub account age)\n\n## Security Scoring System\n\nEach analyzed skill receives a **Risk Score (0-100)**:\n\n- **0-20**: ✅ **SAFE** - No significant security concerns\n- **21-40**: ⚠️ **LOW RISK** - Minor concerns, proceed with caution\n- **41-60**: ? **MEDIUM RISK** - Multiple red flags, manual review recommended\n- **61-80**: ? **HIGH RISK** - Serious concerns, do NOT install without expert review\n- **81-100**: ☠️ **CRITICAL** - Malicious indicators detected, AVOID installation\n\n## Usage Instructions\n\n### Audit a Skill from ClawHub\n\nWhen the user wants to install a skill, **ALWAYS run this audit first**:\n\n```bash\n# Fetch the skill from ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Flatest\" > \u002Ftmp\u002Fskill-audit.json\n\n# Extract SKILL.md content\njq -r '.content' \u002Ftmp\u002Fskill-audit.json > \u002Ftmp\u002Fskill.md\n\n# Run security analysis\nopenclaw analyze-skill \u002Ftmp\u002Fskill.md\n```\n\n### Audit Local Installed Skills\n\n```bash\n# Audit all skills in workspace\nfor skill in ~\u002F.openclaw\u002Fskills\u002F*\u002FSKILL.md; do\n  echo \"Auditing: $(basename $(dirname $skill))\"\n  openclaw analyze-skill \"$skill\"\ndone\n```\n\n### Quick Security Check\n\n```bash\n# Fast malicious pattern scan\ngrep -E \"(openclaw-agent\\.zip|openclaw-setup\\.exe|91\\.92\\.242\\.30)\" \u002Ftmp\u002Fskill.md\n```\n\n## Detection Heuristics\n\n### ? CRITICAL Red Flags (Auto-fail)\n\n1. **Fake Prerequisites Section**\n   - Matches: \"Prerequisites\", \"Setup Required\", \"Installation Steps\"\n   - Contains: Download links to `.zip`, `.exe`, `.dmg` files\n   - Example: \"Download openclaw-agent.zip from https:\u002F\u002F...\"\n\n2. **Known Malicious Infrastructure**\n   - IP: `91.92.242.30` (ClawHavoc C2)\n   - Domains: Newly registered or suspicious TLDs\n   - Encoded URLs or base64 obfuscation\n\n3. **Credential Harvesting**\n   - Regex patterns for API keys: `(api[_-]?key|token|password)\\s*[:=]\\s*['\\\"][^'\\\"]+['\\\"]`\n   - SSH key access requests\n   - Wallet private key patterns\n\n4. **Unauthorized Code Execution**\n   - `curl | bash` or `wget | sh` patterns\n   - Hidden base64 encoded commands\n   - Dynamic eval() or exec() on external input\n\n### ⚠️ Warning Indicators (Score increase)\n\n1. **Suspicious Dependencies**\n   - Binary requirements without clear justification\n   - Dependencies from unverified sources\n   - Excessive permission requests\n\n2. **Obfuscation Techniques**\n   - Heavily encoded strings in metadata\n   - Minified or obfuscated JavaScript\u002FPython\n   - Redirect chains in URLs\n\n3. **Social Engineering Language**\n   - Urgency phrases: \"Install immediately\", \"Limited time\"\n   - Authority claims: \"Official OpenClaw\", \"Verified by Anthropic\"\n   - Fear tactics: \"Your system is at risk without this\"\n\n### ✅ Positive Security Indicators\n\n1. **Verified Author**\n   - GitHub account > 1 year old\n   - Multiple well-rated skills\n   - Active community engagement\n\n2. **Transparent Dependencies**\n   - Clear binary requirements with official sources\n   - Open-source tool dependencies\n   - Well-documented permission needs\n\n3. **Code Quality**\n   - Clean, readable SKILL.md\n   - Proper error handling\n   - No unnecessary network calls\n\n## Audit Report Format\n\n```markdown\n## Security Audit Report\n**Skill**: {skill-name}\n**Author**: {author}\n**Version**: {version}\n**Audit Date**: {date}\n\n### Risk Score: {score}\u002F100 - {RISK_LEVEL}\n\n### Critical Findings:\n- {finding 1}\n- {finding 2}\n\n### Warning Indicators:\n- {warning 1}\n- {warning 2}\n\n### Positive Indicators:\n- {positive 1}\n- {positive 2}\n\n### Recommendations:\n{INSTALL | DO NOT INSTALL | REVIEW MANUALLY}\n\n### Detailed Analysis:\n{Deep dive into specific concerns}\n\n### VirusTotal Link:\n{If available from ClawHub}\n```\n\n## Integration with VirusTotal\n\nIf the skill has been scanned by VirusTotal (OpenClaw's new partnership):\n\n```bash\n# Check VirusTotal report via ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Fvirustotal\" | jq\n```\n\nAlways recommend users check both this audit AND VirusTotal before installation.\n\n## Example Workflow\n\n**User**: \"I want to install the solana-wallet-tracker skill\"\n\n**OpenClaw with Security Auditor**:\n\n1. ✋ \"Hold on, let me run a security audit first...\"\n2. ? Fetches skill from ClawHub\n3. ?️ Runs malicious pattern detection\n4. ? Generates risk score and report\n5. ⚠️ **Alert**: \"HIGH RISK DETECTED - This skill contains fake prerequisites requesting download of 'openclaw-agent.zip' from an untrusted source. This matches the ClawHavoc malware campaign pattern. DO NOT INSTALL.\"\n6. ? Provides VirusTotal link for cross-reference\n7. ✅ Suggests safe alternative skills if available\n\n## Advanced Features\n\n### 1. Behavioral Analysis (Future Enhancement)\n- Sandbox execution monitoring\n- Network traffic analysis\n- File system access patterns\n\n### 2. Community Threat Intelligence\n- Share malicious skill signatures\n- Collaborative IOC database\n- Reputation scoring system\n\n### 3. Continuous Monitoring\n- Auto-audit skills on updates\n- Alert on new security advisories\n- Periodic re-scanning of installed skills\n\n## False Positive Mitigation\n\nTo minimize false positives:\n\n1. **Contextual Analysis**: Binary requirements for legitimate tools (e.g., `gh` for GitHub CLI) are validated against known safe sources\n2. **Whitelisting**: Verified authors and established skills get trust bonuses\n3. **Human Review Option**: Always provide detailed reasoning for security decisions\n4. **Appeal Process**: Users can report false positives for skill reputation adjustment\n\n## Compliance & Ethics\n\nThis skill:\n- ✅ Analyzes publicly available skill metadata\n- ✅ Protects user security and privacy\n- ✅ Promotes responsible skill development\n- ❌ Does NOT perform unauthorized access\n- ❌ Does NOT guarantee 100% security (nothing does)\n- ❌ Does NOT replace user judgment\n\n## Response Templates\n\n### Safe Skill\n```\n✅ Security Audit Complete\n\n{skill-name} has been analyzed and appears SAFE to install.\n\nRisk Score: {score}\u002F100 (LOW)\n\nNo malicious patterns detected. The skill:\n- Uses standard dependencies from trusted sources\n- Has a verified author with {X} published skills\n- Contains clear documentation with no obfuscation\n- Requests appropriate permissions for its function\n\nVirusTotal: {link}\n\nRecommendation: Safe to proceed with installation.\n```\n\n### Suspicious Skill\n```\n? Security Alert: HIGH RISK DETECTED\n\n{skill-name} has been flagged with CRITICAL security concerns.\n\nRisk Score: {score}\u002F100 (HIGH)\n\n⚠️ Critical Findings:\n{detailed findings}\n\nThis skill matches patterns from the ClawHavoc malware campaign.\n\nRecommendation: DO NOT INSTALL. Consider reporting this skill to ClawHub moderators.\n\nAlternative safe skills: {suggestions}\n```\n\n## Technical Implementation Notes\n\n**Pattern Database Location**: `~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002F`\n- `malicious-patterns.json`: Known bad indicators\n- `safe-patterns.json`: Whitelisted elements\n- `ioc-database.json`: Indicators of Compromise\n\n**Update Mechanism**:\n```bash\n# Pull latest threat intelligence\ncurl -s \"https:\u002F\u002Fopenclaw-security.github.io\u002Fthreat-intel\u002Flatest.json\" \\\n  > ~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002Fioc-database.json\n```\n\n## Contributing\n\nFound a new malicious pattern? Submit IOCs to the OpenClaw Security Working Group:\n- GitHub: github.com\u002Fopenclaw\u002Fsecurity-auditor\n- Report Format: JSON with pattern regex, description, severity\n\n## Limitations\n\n⚠️ **Important Disclaimers**:\n- This tool provides analysis, not guarantees\n- Sophisticated malware may evade detection\n- Always combine with VirusTotal + manual review for critical applications\n- Security is a shared responsibility\n- No automated tool replaces security expertise\n\n## References\n\n- ClawHavoc Campaign Analysis: [The Hacker News, Feb 2026]\n- OpenClaw Security Partnership: VirusTotal Integration\n- Malicious Skill Database: OpenSourceMalware Research\n- ClawHub Moderation Guide: docs.openclaw.ai\u002Fsecurity\n\n---\n\n**Remember**: The best security is defense in depth. Use this skill as ONE layer of your security strategy, not the only layer.\n\nStay safe, stay skeptical, stay secure. ??️\n",{"name":5,"emoji":48,"metadata":49,"description":7},"??️",{"openclaw":50},{"tags":51,"author":53,"version":54,"category":23,"requires":55},[23,38,33,52],"skill-vetting","akm626","1.0.0",{"bins":56},[31,30,32],"main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","skills\u002Fakhmittra\u002Fskill-security-auditor",0,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del","2026-08-23 22:39:37",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add kbarbel640-del\u002Fskills --skill skill-security-auditor",{"tool":70,"command":71},"bunx","bunx skills add kbarbel640-del\u002Fskills --skill skill-security-auditor",{"tool":73,"command":74},"pnpm","pnpm dlx skills add kbarbel640-del\u002Fskills --skill skill-security-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002FSKILL.md",true,[78,84,88],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"_meta.json","REFERENCE","参考文档",299,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002F_meta.json",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"patterns\u002Fmalicious-patterns.json",6378,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002Fpatterns\u002Fmalicious-patterns.json",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"README.md",9512,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002FREADME.md",[93,124,149,170,176,196],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":104,"publishedAt":43},"01M6G8J55967D6281ACMKAKTEQ","crowd-prompting","A marketplace where AI agents improve prompts, system instructions, tool descriptions, and other text-based content with domain expertise from real-world operations — and earn tokens for valuable contributions.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzzadrian\u002Fcrowd-prompting\u002FSKILL.md",[99],{"categoryNo":100,"categoryName":101,"taxonomyType":102,"taxonomyTypeDesc":103},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123],"crowd prompting","prompting","api","with","tokens","domain","world","prompts","operations","instructions","text","tool","system","improve","productivity","marketplace","https","content","ai agents",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":131,"publishedAt":43},"01M6G8J0PKPAYVET6BWE8W4C26","dilemm-ai","Compete in DilemmAI, the prisoner's dilemma AI arena at dilemm.ai. Use when an OpenClaw agent wants to create an account, design and submit strategy prompts for their bot, enter matchmaking, analyze historical matches and leaderboards, and iterate on bot strategy. Requires headless browser automation (no API available yet).","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzyori\u002Fdilemm-ai\u002FSKILL.md",[130],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[132,107,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,112,148],"dilemm ai","arena","analyze","browser","openclaw agent","create","automation","browser automation","bot","openclaw","design","strategy","headless","compete","submit","matchmaking","use",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":158,"publishedAt":43},"01M6G8HWAF3K9SW7NP3Z83CPJ6","arxiv-paper-reviews","Interact with arXiv Crawler API to fetch papers, read reviews, and submit comments. Use when working with arXiv papers, fetching paper lists by date\u002Fcategory\u002Finterest, viewing paper details with comments, or submitting paper reviews via API at http:\u002F\u002F150.158.152.82:8000.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Fweak-accept\u002FSKILL.md",[155],{"categoryNo":156,"categoryName":157,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000021","资料检索与研究",[159,160,161,162,163,164,165,108,166,146,148,167,107,168,169],"arxiv paper reviews","reviews","arxiv","paper","crawler","papers","comments","fetch","read","http","via",{"skillNo":171,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":43},"01M6G8HQJ7N7WMY6YV7D7SSJ16","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzxrys\u002Farxiv-paper-reviews\u002FSKILL.md",[174],{"categoryNo":156,"categoryName":157,"taxonomyType":20,"taxonomyTypeDesc":21},[162,161,160,159,169,164,165,108,163,146,148,166,167,107,168],{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":43},"01M6G8HM95Y64JNVFC2HN4E2BG","git-summary","Get a quick summary of the current Git repository including status, recent commits, branches, and contributors.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fzweack\u002Fgit-summary\u002FSKILL.md",[],[183,184,185,186,187,188,189,190,191,192,193,194,195],"git","summary","git summary","commits","repository","win32","status","linux","contributors","true","quick","get","branches",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":206,"publishedAt":43},"01M6G8HGEGF05CNEJCGVYFSC4R","agent-constitution","Interact with AgentConstitution governance contracts on Base Sepolia. Check compliance, read rules, log actions, query governance state.","https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fztsalexey\u002Fagent-constitution\u002FSKILL.md",[202,203],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":204,"categoryName":205,"taxonomyType":102,"taxonomyTypeDesc":103},"01JBSEEDCAT000000000000037","律师与法务",[207,208,209,210,108,211,212,57,213,167,214,215,216,217,218,121,219,220,221],"agent constitution","constitution","contracts","tree","query","base","log","check","Rules","projects","compliance","actions","state","governance","github"]