Pre-install security scanner for AI agent skills.

What it does

6-phase security audit before installing third-party skills:

• Surface scan: Detect 30+ malicious patterns (curl|bash, base64, instruction override)
• Script inspection: Review all referenced scripts
• Permission audit: Check if permissions match purpose
• Social engineering check: Detect manipulation tactics
• Repo intelligence: Evaluate author credibility
• Risk scoring: 0-100 with clear thresholds

Why it's needed

• 7.5% of 14,706 OpenClaw skills are confirmed malicious (RankClaw 2026)
• 59 critical-risk skills found: base64-obfuscated droppers disguised as legitimate tools
• Cisco, CrowdStrike, NCC Group all published skill supply chain attack reports

Links

• Repository: https://github.com/aptratcn/skill-audit
• Attack pattern reference: 50+ documented patterns from real incidents

Addresses critical supply chain security gap. Zero dependencies.