Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sickn33/skill-audit
Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.
Passed 19 of 22 test cases with the skill, and 14 of 22 without it.
and 3 more in the full report
5 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
A proposed extension repository displays base64 decoded shell calls, attempts to read ~/.env, and targets an external unverified IP address. What numerical risk category and install recommendation should be assigned to this assessment?
| Checked | Without skill | With skill |
|---|---|---|
| assigns a risk score within the 70 to 100 range | Missed | Passed |
| recommends against installing the extension | Passed | Passed |
The instructions your model reads when the skill loads.
7.5% of 14,706 OpenClaw skills are confirmed malicious. This skill provides a structured 6-phase security review you run before installing any third-party skill.
Research findings (2026):
Pattern detection in SKILL.md:
ignore previous instructions, you are now...fetch(), curl, wget to unknown domainsatob(), base64 strings~/.env, process.env + network callsRead every referenced script:
Check if permissions match purpose:
test cases passed, vs 14 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.