Skill: sudhindrat/skill-security-scan (version 1.0.0)

--- name: skill-security description: Security checks for installing skills, packages, or plugins. Use BEFORE any `npm install`, `openclaw plugins install`, `clawhub install`, or similar install commands. Also use when reviewing a newly installed skill before first use. Triggered by any install, add, or package addition request. --- # Skill Security Run these checks before installing ANY skill, package, or plugin. Always warn the user before proceeding. ## Pre-Install Checklist ### 1. Source Verification - Is it from clawhub.com (vetted) or a random npm package? - Who's the author? Do they have other packages / reputation? - Is there a GitHub repo? Check for recent commits, open issues, maintainer activity. ### 2. Popularity Check - `npm info <package>` — check weekly downloads, last publish date, version history - Low downloads (< 100/week) + recent publish = higher risk ### 3. Dependency Audit - `npm info <package> dependencies` — how many deps does it pull in? - More dependencies = larger attack surface - Flag packages with 50+ transitive dependencies ### 4. Lifecycle Scripts (HIGH RISK) - Check for `preinstall`, `install`, `postinstall` scripts — these run arbitrary code - `npm info <package> scripts` or inspect `package.json` - pnpm blocks these by default; npm does NOT - If lifecycle scripts exist, flag it explicitly to the user ### 5. Scan After Install - `npm audit` after install to catch known vulnerabilities ### 6. Check for Dynamic Content - Search the skill code for URLs that are fetched at runtime - Skills that download and execute content from external endpoints can change behavior after install ## Red Flags — Stop and Ask - 🚩 Package published very recently with no history - 🚩 Maintainer has no other packages or reputation - 🚩 Package name similar to a popular one (typosquatting: e.g., `reqeust` vs `request`) - 🚩 Requests permissions beyond what it claims to do - 🚩 No GitHub repo, or repo is empty/suspicious - 🚩 Postinstall scripts that download from unknown URLs - 🚩 **Dynamic content fetching** — skill calls external URLs at runtime (2.9% of ClawHub skills do this; payload can change after install) - 🚩 **Base64 in install instructions** — ClickFix social engineering pattern (fake errors → paste base64 command → malware) - 🚩 **New uploader, bulk uploads** — single user uploading many skills rapidly (ClawHavoc: 354 skills from one account) - 🚩 **Skill references credential paths** — `~/.openclaw/credentials/`, `~/.clawdbot/.env`, `.env` files ## Core File Protection Skills are NEVER allowed to modify these files without explicit user approval: - `SOUL.md` — agent identity - `AGENTS.md` — agent rules - `IDENTITY.md` — agent metadata - `USER.md` — user's personal info - `MEMORY.md` or `memory/*.md` — agent memories - `TOOLS.md` — infrastructure notes ## Data Exfiltration Checks After installing a skill, before running it: 1. **Read SKILL.md** — understand what the skill does 2. **Check file paths** — does it reference paths outside its own directory and workspace? 3. **Check exec commands** — does it `curl` to unknown domains? 4. **Check write/edit calls** — are target paths outside `workspace/`? 5. **Check for credential access** — `.env`, `~/.ssh/`, `~/.gnupg/`, API keys 6. **Check for dynamic content** — does it fetch and execute content from external URLs at runtime? (Snyk: 2.9% of ClawHub skills do this) ## ClawHub-Specific Checks When installing from ClawHub: - **Check uploader history** — is this a new account? Do they have other skills? Bulk uploads from unknown accounts = red flag (ClawHavoc: 354 skills from one malicious account) - **Check skill stars/reviews** — community feedback is a signal, not proof - **Check VirusTotal** — OpenClaw has a VirusTotal partnership; check if the skill has been scanned - **Verify semantic versioning** — legitimate skills typically have version history and changelogs - **Search for security reports** — search web for "[skill-name] malicious" before installing ## Known Attack Campaigns (as of March 2026) Reference for identifying patterns: - **ClawHavoc** — 300+ coordinated skills, ClickFix social engineering, downloads Atomic Stealer (AMOS) - **AuthTool** — dormant payload, activates on specific natural language prompts, establishes reverse shell - **Hidden Backdoor** — fake "Apple Software Update" during install, encrypted tunnel to attacker - **Credential Exfiltration** — targets `~/.clawdbot/.env` and `~/.openclaw/credentials/` for API keys ## Red Flags — Skill Behavior - 🚩 Skill reads `.env` or credential files - 🚩 Skill makes network requests to unfamiliar domains - 🚩 Skill writes to paths outside workspace - 🚩 Skill modifies core files (SOUL, AGENTS, MEMORY, USER, IDENTITY, TOOLS) - 🚩 Skill sends data to external URLs not part of stated purpose ## What To Tell The User Before installing, give a brief summary: > "⚠️ Installing [package]: [downloads/week], [last updated], [dep count] deps, [lifecycle scripts?]. Looks [clean/sketchy] — proceed?" If red flags found: > "🚩 Flags on [package]: [list issues]. Want me to proceed anyway?"


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)