Skill Security Auditor#

Audit skills for supply-chain, privilege, and automation risk before adoption.

Input#

Required:

• skill_manifest — the skill's SKILL.md or metadata
• source_location — where the skill comes from (clawhub, git, local, unknown)
• required_permissions — what permissions the skill requests
• shell_commands — any shell/CLI commands referenced by the skill
• env_usage — environment variables the skill reads or writes
• install_steps — how the skill is installed / what it runs on install

Output Schema#

text

risk_level: "low" | "medium" | "high" | "critical"

suspicious_actions: {
  action: string
  location: string
  severity: "warning" | "critical"
  description: string
  recommendation: string
}[]

over_privileged_points: {
  permission: string
  why_needed: string | null
  why_excessive: string
  recommendation: string
}[]

install_recommendation: "approve" | "approve_with_sandbox" | "reject" | "manual_review"

sandbox_recommendation: {
  recommended: boolean
  isolation_level: "none" | "process" | "network" | "full"
  reasons: string[]
} | null

audit_summary: string    # one paragraph honest summary

Risk Levels#

LevelCriterialowMinimal permissions, no shell, no env secrets, known sourcemediumSome filesystem access or env usage, known sourcehighShell commands, broad permissions, or unknown sourcecriticalOpaque install scripts, secret access, eval/exec patterns

Suspicious Actions to Flag#

• eval, exec, Function() — code execution
• curl / wget with pipe to shell — remote code download
• chmod +x / sudo — privilege escalation
• Reading ~/.ssh, /etc/passwd, environment secrets
• Network calls to unknown hosts
• Base64-encoded or obfuscated commands
• Install scripts that fetch from unknown URLs

Over-Privileged Points to Flag#

• Filesystem access beyond the skill's stated scope
• Broad read permissions on entire directories
• write access to system paths
• Environment variables containing tokens/keys
• Network access not strictly needed for stated function

Source Trust Levels#

SourceTrustClawHub verifiedmedium (review anyway)Known git repomediumLocal skillhighUnknown URLlowCopy-pasted codevery low

Rules#

1. Never default-approve high-privilege skills. Burden of proof is on the skill, not the auditor.
2. Flag remote install scripts and opaque shell chains. If you can't see what runs, flag it.
3. Flag access to secrets, env vars, filesystem, or network where not strictly needed.
4. Recommend isolation for untrusted skills. Better safe than sorry.

Failure Handling#

If source trust cannot be established:

• Default to risk_level = "high" minimum
• Recommend reject or manual_review
• Do not fabricate a clean audit
• Explicitly state what could not be verified