[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KNETZYSC9ENKVCBAYFTGFT":3,"skill-same:01M6KNETZYSC9ENKVCBAYFTGFT":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":56,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6KNETZYSC9ENKVCBAYFTGFT","tools-creusot-annotate-interfaces",null,"Formally verify a component's properties with Creusot and annotate its interface definitions","AI-native-Systems-Research\u002Fai-native-storage-certus","AI-native-Systems-Research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F270755458?v=4","01M6KKQWSJX0D4X33E0KKSR4WM","AI-native Systems Research","01M6KKQWXTKR6MYVQMPKVJ5WD5",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Feviction-policy-session-lists\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27],"Tools","annotate","tools creusot annotate interfaces","component","verify","properties","name","with","interface","2026-11-10 10:12:30",false,"---\nname: skill-security-auditor\ndescription: Pre-installation security auditor for ClawHub skills. Analyzes SKILL.md files, dependencies, and code for malicious patterns, credential leaks, suspicious prerequisites, and C2 infrastructure indicators before installation.\nemoji: ??️\nmetadata:\n  openclaw:\n    requires:\n      bins: [\"curl\", \"jq\", \"grep\"]\n    version: \"1.0.0\"\n    author: \"akm626\"\n    category: \"security\"\n    tags: [\"security\", \"audit\", \"malware-detection\", \"skill-vetting\"]\n---\n\n# Skill Security Auditor\n\n## Description\n\nThe Skill Security Auditor is a defensive cybersecurity tool designed to protect OpenClaw users from malicious ClawHub skills. Given the recent discovery of 341+ malicious skills (ClawHavoc campaign) that distributed Atomic Stealer (AMOS) and stole cryptocurrency credentials, this skill provides **pre-installation security analysis** of skills before they're added to your workspace.\n\n**Use this skill when:**\n- About to install a new skill from ClawHub\n- Investigating suspicious skill behavior\n- Performing security due diligence on community skills\n- Auditing your currently installed skills\n- User requests security vetting of a skill\n\n**This skill does NOT replace:**\n- VirusTotal scanning (complementary)\n- Manual code review (recommended for critical use)\n- Your own security judgment\n\n## Core Capabilities\n\n### 1. **Malicious Pattern Detection**\nScans for known malicious patterns from the ClawHavoc campaign:\n- Fake prerequisite installations (openclaw-agent.zip, openclaw-setup.exe)\n- Suspicious download commands in SKILL.md\n- Hidden payload execution in metadata\n- Social engineering language patterns\n- Unauthorized external binary downloads\n\n### 2. **Credential Leak Analysis**\nIdentifies potential credential exposure vectors:\n- Hardcoded API keys, tokens, passwords in SKILL.md\n- Suspicious environment variable exfiltration\n- Unencrypted sensitive data transmission\n- Overly broad permission requests\n- Credential harvesting patterns\n\n### 3. **Dependency Chain Validation**\nAnalyzes skill dependencies for:\n- Unverified binary requirements\n- Suspicious GitHub repository sources\n- External script execution\n- Network connections to unknown hosts\n- Nested dependency exploitation\n\n### 4. **C2 Infrastructure Detection**\nChecks for Command & Control indicators:\n- Known malicious IP addresses (e.g., 91.92.242.30 from ClawHavoc)\n- Suspicious domain patterns\n- Encoded communication endpoints\n- Data exfiltration channels\n- Beaconing behavior patterns\n\n### 5. **SKILL.md Structure Validation**\nVerifies skill integrity:\n- Proper YAML frontmatter structure\n- Metadata consistency\n- Description clarity vs actual behavior\n- Permission justification\n- Author verification (GitHub account age)\n\n## Security Scoring System\n\nEach analyzed skill receives a **Risk Score (0-100)**:\n\n- **0-20**: ✅ **SAFE** - No significant security concerns\n- **21-40**: ⚠️ **LOW RISK** - Minor concerns, proceed with caution\n- **41-60**: ? **MEDIUM RISK** - Multiple red flags, manual review recommended\n- **61-80**: ? **HIGH RISK** - Serious concerns, do NOT install without expert review\n- **81-100**: ☠️ **CRITICAL** - Malicious indicators detected, AVOID installation\n\n## Usage Instructions\n\n### Audit a Skill from ClawHub\n\nWhen the user wants to install a skill, **ALWAYS run this audit first**:\n\n```bash\n# Fetch the skill from ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Flatest\" > \u002Ftmp\u002Fskill-audit.json\n\n# Extract SKILL.md content\njq -r '.content' \u002Ftmp\u002Fskill-audit.json > \u002Ftmp\u002Fskill.md\n\n# Run security analysis\nopenclaw analyze-skill \u002Ftmp\u002Fskill.md\n```\n\n### Audit Local Installed Skills\n\n```bash\n# Audit all skills in workspace\nfor skill in ~\u002F.openclaw\u002Fskills\u002F*\u002FSKILL.md; do\n  echo \"Auditing: $(basename $(dirname $skill))\"\n  openclaw analyze-skill \"$skill\"\ndone\n```\n\n### Quick Security Check\n\n```bash\n# Fast malicious pattern scan\ngrep -E \"(openclaw-agent\\.zip|openclaw-setup\\.exe|91\\.92\\.242\\.30)\" \u002Ftmp\u002Fskill.md\n```\n\n## Detection Heuristics\n\n### ? CRITICAL Red Flags (Auto-fail)\n\n1. **Fake Prerequisites Section**\n   - Matches: \"Prerequisites\", \"Setup Required\", \"Installation Steps\"\n   - Contains: Download links to `.zip`, `.exe`, `.dmg` files\n   - Example: \"Download openclaw-agent.zip from https:\u002F\u002F...\"\n\n2. **Known Malicious Infrastructure**\n   - IP: `91.92.242.30` (ClawHavoc C2)\n   - Domains: Newly registered or suspicious TLDs\n   - Encoded URLs or base64 obfuscation\n\n3. **Credential Harvesting**\n   - Regex patterns for API keys: `(api[_-]?key|token|password)\\s*[:=]\\s*['\\\"][^'\\\"]+['\\\"]`\n   - SSH key access requests\n   - Wallet private key patterns\n\n4. **Unauthorized Code Execution**\n   - `curl | bash` or `wget | sh` patterns\n   - Hidden base64 encoded commands\n   - Dynamic eval() or exec() on external input\n\n### ⚠️ Warning Indicators (Score increase)\n\n1. **Suspicious Dependencies**\n   - Binary requirements without clear justification\n   - Dependencies from unverified sources\n   - Excessive permission requests\n\n2. **Obfuscation Techniques**\n   - Heavily encoded strings in metadata\n   - Minified or obfuscated JavaScript\u002FPython\n   - Redirect chains in URLs\n\n3. **Social Engineering Language**\n   - Urgency phrases: \"Install immediately\", \"Limited time\"\n   - Authority claims: \"Official OpenClaw\", \"Verified by Anthropic\"\n   - Fear tactics: \"Your system is at risk without this\"\n\n### ✅ Positive Security Indicators\n\n1. **Verified Author**\n   - GitHub account > 1 year old\n   - Multiple well-rated skills\n   - Active community engagement\n\n2. **Transparent Dependencies**\n   - Clear binary requirements with official sources\n   - Open-source tool dependencies\n   - Well-documented permission needs\n\n3. **Code Quality**\n   - Clean, readable SKILL.md\n   - Proper error handling\n   - No unnecessary network calls\n\n## Audit Report Format\n\n```markdown\n## Security Audit Report\n**Skill**: {skill-name}\n**Author**: {author}\n**Version**: {version}\n**Audit Date**: {date}\n\n### Risk Score: {score}\u002F100 - {RISK_LEVEL}\n\n### Critical Findings:\n- {finding 1}\n- {finding 2}\n\n### Warning Indicators:\n- {warning 1}\n- {warning 2}\n\n### Positive Indicators:\n- {positive 1}\n- {positive 2}\n\n### Recommendations:\n{INSTALL | DO NOT INSTALL | REVIEW MANUALLY}\n\n### Detailed Analysis:\n{Deep dive into specific concerns}\n\n### VirusTotal Link:\n{If available from ClawHub}\n```\n\n## Integration with VirusTotal\n\nIf the skill has been scanned by VirusTotal (OpenClaw's new partnership):\n\n```bash\n# Check VirusTotal report via ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Fvirustotal\" | jq\n```\n\nAlways recommend users check both this audit AND VirusTotal before installation.\n\n## Example Workflow\n\n**User**: \"I want to install the solana-wallet-tracker skill\"\n\n**OpenClaw with Security Auditor**:\n\n1. ✋ \"Hold on, let me run a security audit first...\"\n2. ? Fetches skill from ClawHub\n3. ?️ Runs malicious pattern detection\n4. ? Generates risk score and report\n5. ⚠️ **Alert**: \"HIGH RISK DETECTED - This skill contains fake prerequisites requesting download of 'openclaw-agent.zip' from an untrusted source. This matches the ClawHavoc malware campaign pattern. DO NOT INSTALL.\"\n6. ? Provides VirusTotal link for cross-reference\n7. ✅ Suggests safe alternative skills if available\n\n## Advanced Features\n\n### 1. Behavioral Analysis (Future Enhancement)\n- Sandbox execution monitoring\n- Network traffic analysis\n- File system access patterns\n\n### 2. Community Threat Intelligence\n- Share malicious skill signatures\n- Collaborative IOC database\n- Reputation scoring system\n\n### 3. Continuous Monitoring\n- Auto-audit skills on updates\n- Alert on new security advisories\n- Periodic re-scanning of installed skills\n\n## False Positive Mitigation\n\nTo minimize false positives:\n\n1. **Contextual Analysis**: Binary requirements for legitimate tools (e.g., `gh` for GitHub CLI) are validated against known safe sources\n2. **Whitelisting**: Verified authors and established skills get trust bonuses\n3. **Human Review Option**: Always provide detailed reasoning for security decisions\n4. **Appeal Process**: Users can report false positives for skill reputation adjustment\n\n## Compliance & Ethics\n\nThis skill:\n- ✅ Analyzes publicly available skill metadata\n- ✅ Protects user security and privacy\n- ✅ Promotes responsible skill development\n- ❌ Does NOT perform unauthorized access\n- ❌ Does NOT guarantee 100% security (nothing does)\n- ❌ Does NOT replace user judgment\n\n## Response Templates\n\n### Safe Skill\n```\n✅ Security Audit Complete\n\n{skill-name} has been analyzed and appears SAFE to install.\n\nRisk Score: {score}\u002F100 (LOW)\n\nNo malicious patterns detected. The skill:\n- Uses standard dependencies from trusted sources\n- Has a verified author with {X} published skills\n- Contains clear documentation with no obfuscation\n- Requests appropriate permissions for its function\n\nVirusTotal: {link}\n\nRecommendation: Safe to proceed with installation.\n```\n\n### Suspicious Skill\n```\n? Security Alert: HIGH RISK DETECTED\n\n{skill-name} has been flagged with CRITICAL security concerns.\n\nRisk Score: {score}\u002F100 (HIGH)\n\n⚠️ Critical Findings:\n{detailed findings}\n\nThis skill matches patterns from the ClawHavoc malware campaign.\n\nRecommendation: DO NOT INSTALL. Consider reporting this skill to ClawHub moderators.\n\nAlternative safe skills: {suggestions}\n```\n\n## Technical Implementation Notes\n\n**Pattern Database Location**: `~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002F`\n- `malicious-patterns.json`: Known bad indicators\n- `safe-patterns.json`: Whitelisted elements\n- `ioc-database.json`: Indicators of Compromise\n\n**Update Mechanism**:\n```bash\n# Pull latest threat intelligence\ncurl -s \"https:\u002F\u002Fopenclaw-security.github.io\u002Fthreat-intel\u002Flatest.json\" \\\n  > ~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002Fioc-database.json\n```\n\n## Contributing\n\nFound a new malicious pattern? Submit IOCs to the OpenClaw Security Working Group:\n- GitHub: github.com\u002Fopenclaw\u002Fsecurity-auditor\n- Report Format: JSON with pattern regex, description, severity\n\n## Limitations\n\n⚠️ **Important Disclaimers**:\n- This tool provides analysis, not guarantees\n- Sophisticated malware may evade detection\n- Always combine with VirusTotal + manual review for critical applications\n- Security is a shared responsibility\n- No automated tool replaces security expertise\n\n## References\n\n- ClawHavoc Campaign Analysis: [The Hacker News, Feb 2026]\n- OpenClaw Security Partnership: VirusTotal Integration\n- Malicious Skill Database: OpenSourceMalware Research\n- ClawHub Moderation Guide: docs.openclaw.ai\u002Fsecurity\n\n---\n\n**Remember**: The best security is defense in depth. Use this skill as ONE layer of your security strategy, not the only layer.\n\nStay safe, stay skeptical, stay secure. ??️\n","# Skill Security Auditor\n\n## Description\n\nThe Skill Security Auditor is a defensive cybersecurity tool designed to protect OpenClaw users from malicious ClawHub skills. Given the recent discovery of 341+ malicious skills (ClawHavoc campaign) that distributed Atomic Stealer (AMOS) and stole cryptocurrency credentials, this skill provides **pre-installation security analysis** of skills before they're added to your workspace.\n\n**Use this skill when:**\n- About to install a new skill from ClawHub\n- Investigating suspicious skill behavior\n- Performing security due diligence on community skills\n- Auditing your currently installed skills\n- User requests security vetting of a skill\n\n**This skill does NOT replace:**\n- VirusTotal scanning (complementary)\n- Manual code review (recommended for critical use)\n- Your own security judgment\n\n## Core Capabilities\n\n### 1. **Malicious Pattern Detection**\nScans for known malicious patterns from the ClawHavoc campaign:\n- Fake prerequisite installations (openclaw-agent.zip, openclaw-setup.exe)\n- Suspicious download commands in SKILL.md\n- Hidden payload execution in metadata\n- Social engineering language patterns\n- Unauthorized external binary downloads\n\n### 2. **Credential Leak Analysis**\nIdentifies potential credential exposure vectors:\n- Hardcoded API keys, tokens, passwords in SKILL.md\n- Suspicious environment variable exfiltration\n- Unencrypted sensitive data transmission\n- Overly broad permission requests\n- Credential harvesting patterns\n\n### 3. **Dependency Chain Validation**\nAnalyzes skill dependencies for:\n- Unverified binary requirements\n- Suspicious GitHub repository sources\n- External script execution\n- Network connections to unknown hosts\n- Nested dependency exploitation\n\n### 4. **C2 Infrastructure Detection**\nChecks for Command & Control indicators:\n- Known malicious IP addresses (e.g., 91.92.242.30 from ClawHavoc)\n- Suspicious domain patterns\n- Encoded communication endpoints\n- Data exfiltration channels\n- Beaconing behavior patterns\n\n### 5. **SKILL.md Structure Validation**\nVerifies skill integrity:\n- Proper YAML frontmatter structure\n- Metadata consistency\n- Description clarity vs actual behavior\n- Permission justification\n- Author verification (GitHub account age)\n\n## Security Scoring System\n\nEach analyzed skill receives a **Risk Score (0-100)**:\n\n- **0-20**: ✅ **SAFE** - No significant security concerns\n- **21-40**: ⚠️ **LOW RISK** - Minor concerns, proceed with caution\n- **41-60**: ? **MEDIUM RISK** - Multiple red flags, manual review recommended\n- **61-80**: ? **HIGH RISK** - Serious concerns, do NOT install without expert review\n- **81-100**: ☠️ **CRITICAL** - Malicious indicators detected, AVOID installation\n\n## Usage Instructions\n\n### Audit a Skill from ClawHub\n\nWhen the user wants to install a skill, **ALWAYS run this audit first**:\n\n```bash\n# Fetch the skill from ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Flatest\" > \u002Ftmp\u002Fskill-audit.json\n\n# Extract SKILL.md content\njq -r '.content' \u002Ftmp\u002Fskill-audit.json > \u002Ftmp\u002Fskill.md\n\n# Run security analysis\nopenclaw analyze-skill \u002Ftmp\u002Fskill.md\n```\n\n### Audit Local Installed Skills\n\n```bash\n# Audit all skills in workspace\nfor skill in ~\u002F.openclaw\u002Fskills\u002F*\u002FSKILL.md; do\n  echo \"Auditing: $(basename $(dirname $skill))\"\n  openclaw analyze-skill \"$skill\"\ndone\n```\n\n### Quick Security Check\n\n```bash\n# Fast malicious pattern scan\ngrep -E \"(openclaw-agent\\.zip|openclaw-setup\\.exe|91\\.92\\.242\\.30)\" \u002Ftmp\u002Fskill.md\n```\n\n## Detection Heuristics\n\n### ? CRITICAL Red Flags (Auto-fail)\n\n1. **Fake Prerequisites Section**\n   - Matches: \"Prerequisites\", \"Setup Required\", \"Installation Steps\"\n   - Contains: Download links to `.zip`, `.exe`, `.dmg` files\n   - Example: \"Download openclaw-agent.zip from https:\u002F\u002F...\"\n\n2. **Known Malicious Infrastructure**\n   - IP: `91.92.242.30` (ClawHavoc C2)\n   - Domains: Newly registered or suspicious TLDs\n   - Encoded URLs or base64 obfuscation\n\n3. **Credential Harvesting**\n   - Regex patterns for API keys: `(api[_-]?key|token|password)\\s*[:=]\\s*['\\\"][^'\\\"]+['\\\"]`\n   - SSH key access requests\n   - Wallet private key patterns\n\n4. **Unauthorized Code Execution**\n   - `curl | bash` or `wget | sh` patterns\n   - Hidden base64 encoded commands\n   - Dynamic eval() or exec() on external input\n\n### ⚠️ Warning Indicators (Score increase)\n\n1. **Suspicious Dependencies**\n   - Binary requirements without clear justification\n   - Dependencies from unverified sources\n   - Excessive permission requests\n\n2. **Obfuscation Techniques**\n   - Heavily encoded strings in metadata\n   - Minified or obfuscated JavaScript\u002FPython\n   - Redirect chains in URLs\n\n3. **Social Engineering Language**\n   - Urgency phrases: \"Install immediately\", \"Limited time\"\n   - Authority claims: \"Official OpenClaw\", \"Verified by Anthropic\"\n   - Fear tactics: \"Your system is at risk without this\"\n\n### ✅ Positive Security Indicators\n\n1. **Verified Author**\n   - GitHub account > 1 year old\n   - Multiple well-rated skills\n   - Active community engagement\n\n2. **Transparent Dependencies**\n   - Clear binary requirements with official sources\n   - Open-source tool dependencies\n   - Well-documented permission needs\n\n3. **Code Quality**\n   - Clean, readable SKILL.md\n   - Proper error handling\n   - No unnecessary network calls\n\n## Audit Report Format\n\n```markdown\n## Security Audit Report\n**Skill**: {skill-name}\n**Author**: {author}\n**Version**: {version}\n**Audit Date**: {date}\n\n### Risk Score: {score}\u002F100 - {RISK_LEVEL}\n\n### Critical Findings:\n- {finding 1}\n- {finding 2}\n\n### Warning Indicators:\n- {warning 1}\n- {warning 2}\n\n### Positive Indicators:\n- {positive 1}\n- {positive 2}\n\n### Recommendations:\n{INSTALL | DO NOT INSTALL | REVIEW MANUALLY}\n\n### Detailed Analysis:\n{Deep dive into specific concerns}\n\n### VirusTotal Link:\n{If available from ClawHub}\n```\n\n## Integration with VirusTotal\n\nIf the skill has been scanned by VirusTotal (OpenClaw's new partnership):\n\n```bash\n# Check VirusTotal report via ClawHub\ncurl -s \"https:\u002F\u002Fclawhub.ai\u002Fapi\u002Fskills\u002F{skill-slug}\u002Fvirustotal\" | jq\n```\n\nAlways recommend users check both this audit AND VirusTotal before installation.\n\n## Example Workflow\n\n**User**: \"I want to install the solana-wallet-tracker skill\"\n\n**OpenClaw with Security Auditor**:\n\n1. ✋ \"Hold on, let me run a security audit first...\"\n2. ? Fetches skill from ClawHub\n3. ?️ Runs malicious pattern detection\n4. ? Generates risk score and report\n5. ⚠️ **Alert**: \"HIGH RISK DETECTED - This skill contains fake prerequisites requesting download of 'openclaw-agent.zip' from an untrusted source. This matches the ClawHavoc malware campaign pattern. DO NOT INSTALL.\"\n6. ? Provides VirusTotal link for cross-reference\n7. ✅ Suggests safe alternative skills if available\n\n## Advanced Features\n\n### 1. Behavioral Analysis (Future Enhancement)\n- Sandbox execution monitoring\n- Network traffic analysis\n- File system access patterns\n\n### 2. Community Threat Intelligence\n- Share malicious skill signatures\n- Collaborative IOC database\n- Reputation scoring system\n\n### 3. Continuous Monitoring\n- Auto-audit skills on updates\n- Alert on new security advisories\n- Periodic re-scanning of installed skills\n\n## False Positive Mitigation\n\nTo minimize false positives:\n\n1. **Contextual Analysis**: Binary requirements for legitimate tools (e.g., `gh` for GitHub CLI) are validated against known safe sources\n2. **Whitelisting**: Verified authors and established skills get trust bonuses\n3. **Human Review Option**: Always provide detailed reasoning for security decisions\n4. **Appeal Process**: Users can report false positives for skill reputation adjustment\n\n## Compliance & Ethics\n\nThis skill:\n- ✅ Analyzes publicly available skill metadata\n- ✅ Protects user security and privacy\n- ✅ Promotes responsible skill development\n- ❌ Does NOT perform unauthorized access\n- ❌ Does NOT guarantee 100% security (nothing does)\n- ❌ Does NOT replace user judgment\n\n## Response Templates\n\n### Safe Skill\n```\n✅ Security Audit Complete\n\n{skill-name} has been analyzed and appears SAFE to install.\n\nRisk Score: {score}\u002F100 (LOW)\n\nNo malicious patterns detected. The skill:\n- Uses standard dependencies from trusted sources\n- Has a verified author with {X} published skills\n- Contains clear documentation with no obfuscation\n- Requests appropriate permissions for its function\n\nVirusTotal: {link}\n\nRecommendation: Safe to proceed with installation.\n```\n\n### Suspicious Skill\n```\n? Security Alert: HIGH RISK DETECTED\n\n{skill-name} has been flagged with CRITICAL security concerns.\n\nRisk Score: {score}\u002F100 (HIGH)\n\n⚠️ Critical Findings:\n{detailed findings}\n\nThis skill matches patterns from the ClawHavoc malware campaign.\n\nRecommendation: DO NOT INSTALL. Consider reporting this skill to ClawHub moderators.\n\nAlternative safe skills: {suggestions}\n```\n\n## Technical Implementation Notes\n\n**Pattern Database Location**: `~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002F`\n- `malicious-patterns.json`: Known bad indicators\n- `safe-patterns.json`: Whitelisted elements\n- `ioc-database.json`: Indicators of Compromise\n\n**Update Mechanism**:\n```bash\n# Pull latest threat intelligence\ncurl -s \"https:\u002F\u002Fopenclaw-security.github.io\u002Fthreat-intel\u002Flatest.json\" \\\n  > ~\u002F.openclaw\u002Fsecurity-auditor\u002Fpatterns\u002Fioc-database.json\n```\n\n## Contributing\n\nFound a new malicious pattern? Submit IOCs to the OpenClaw Security Working Group:\n- GitHub: github.com\u002Fopenclaw\u002Fsecurity-auditor\n- Report Format: JSON with pattern regex, description, severity\n\n## Limitations\n\n⚠️ **Important Disclaimers**:\n- This tool provides analysis, not guarantees\n- Sophisticated malware may evade detection\n- Always combine with VirusTotal + manual review for critical applications\n- Security is a shared responsibility\n- No automated tool replaces security expertise\n\n## References\n\n- ClawHavoc Campaign Analysis: [The Hacker News, Feb 2026]\n- OpenClaw Security Partnership: VirusTotal Integration\n- Malicious Skill Database: OpenSourceMalware Research\n- ClawHub Moderation Guide: docs.openclaw.ai\u002Fsecurity\n\n---\n\n**Remember**: The best security is defense in depth. Use this skill as ONE layer of your security strategy, not the only layer.\n\nStay safe, stay skeptical, stay secure. ??️\n",{"name":33,"emoji":34,"metadata":35,"description":49},"skill-security-auditor","??️",{"openclaw":36},{"tags":37,"author":42,"version":43,"category":38,"requires":44},[38,39,40,41],"security","audit","malware-detection","skill-vetting","akm626","1.0.0",{"bins":45},[46,47,48],"curl","jq","grep","Pre-installation security auditor for ClawHub skills. Analyzes SKILL.md files, dependencies, and code for malicious patterns, credential leaks, suspicious prerequisites, and C2 infrastructure indicators before installation.","main","e7e336ac628c3e3bd771aff1aaa469c93778f94a","components\u002Feviction-policy-session-lists\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces",4,"https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research","https:\u002F\u002Fai-native-systems-research.github.io\u002Fai-native-systems-research\u002F","2026-11-10 09:17:37",{"source":8,"skillName":33,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill skill-security-auditor",{"tool":64,"command":65},"bunx","bunx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill skill-security-auditor",{"tool":67,"command":68},"pnpm","pnpm dlx skills add AI-native-Systems-Research\u002Fai-native-storage-certus --skill skill-security-auditor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Feviction-policy-session-lists\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",true,[72,78,82],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"_meta.json","REFERENCE","参考文档",299,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002F_meta.json",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"patterns\u002Fmalicious-patterns.json",6378,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002Fpatterns\u002Fmalicious-patterns.json",{"path":83,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":84,"sourceHtmlUrl":85},"README.md",9512,"https:\u002F\u002Fgithub.com\u002Fkbarbel640-del\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fakhmittra\u002Fskill-security-auditor\u002FREADME.md",[87,102,118,129,146,158],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":28},"01M6KP29TWSNGADF3AJ47BR7TY","tools-spin-sync","Synchronize Spin\u002FPromela models with current source code and re-verify","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-sync\u002FSKILL.md",[],[94,19,95,96,23,97,98,25,26,99,100,101],"tools spin sync","sync","code","model","models","re","source","source code",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":28},"01M6KP277TDY3ZAJEBP5P6MDT8","tools-spin-model","Create a new Spin\u002FPromela formal verification model for a system property","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-spin-model\u002FSKILL.md",[],[109,97,19,110,111,112,113,114,115,116,117],"tools spin model","system","formal verification","number","for","prove","new","create","verification",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":28},"01M6KP250W406CEDSF02BRXT9D","tools-creusot-install","Install the Creusot Rust verification tool","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-install\u002FSKILL.md",[],[125,126,19,127,117,128],"tools creusot install","install","rust","tool",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":28},"01M6KP22H28FQ1X0V7VJHEFWXD","tools-creusot-init","Prepare an existing Cargo project to use Creusot formal verification","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-init\u002FSKILL.md",[],[136,19,137,138,139,140,141,117,142,111,143,144,145],"tools creusot init","init","project","directory","components","prepare","use","cargo","manager","Existing",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":28},"01M6KP1V506J9YM8DKKVDG1NRE","tools-creusot-coq-install","Add Coq 8.20 as an additional prover to an existing Creusot installation, for verification conditions that SMT solvers cannot discharge","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-coq-install\u002FSKILL.md",[],[153,154,126,19,113,145,155,156,117,157],"tools creusot coq install","Coq","as","installation","add",{"skillNo":159,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":28},"01M6KP1PQJF3H765TYZAZ7P3EF","https:\u002F\u002Fgithub.com\u002FAI-native-Systems-Research\u002Fai-native-storage-certus\u002Fblob\u002Funstable\u002Fcomponents\u002Fzyre\u002F.claude\u002Fskills\u002Ftools-creusot-annotate-interfaces\u002FSKILL.md",[],[19,21,20,26,25,24,23,22,27]]