OpenClaw 생태계에 대한 보안 우선 기술 — 유지 ** useClawPro** (UseAI.pro).

최종 사용자를위한 두 감사 기술, 플러스 11 재사용 가능한 모듈 (advanced checks).

이들은 **실행 모듈 ** (SKILL.md) - 그들은 스스로 실행하지 않습니다. 호스트 에이전트에로드 (Codex CLI / Claude Code / OpenClaw) 또는 LLM 채팅으로 붙여 넣기.

빠른 링크:

• UseClawPro 보안 허브: https://useclaw.pro/
• 기둥 가이드 : https://useclaw.pro/guides/openclaw-security/
• Skill Verifier (브라우저): https://useclaw.pro/verifier/
• 검증된 기술 (catalog): https://useclaw.pro/verified-skills/

퀵스타트

Job 1 - 설치하기 전에 기술 감사

Fast (browser): 기술 URL/name을 UseClawPro Verifier로 붙여넣기.

**Deep (시약) : **로드 skill-auditor 및 대상을 제공합니다 :

openclaw-skills-security

Security-first skills for the OpenClaw ecosystem — maintained by UseClawPro (UseAI.pro).

Two auditor skills for end-users, plus 11 reusable modules (advanced checks).

These are instruction modules (SKILL.md) — they don’t run on their own. Load them into a host agent (Codex CLI / Claude Code / OpenClaw) or paste into any LLM chat.

Quick links:

• UseClawPro security hub: https://useclaw.pro/
• Pillar guide: https://useclaw.pro/guides/openclaw-security/
• Skill Verifier (browser): https://useclaw.pro/verifier/
• Verified Skills (catalog): https://useclaw.pro/verified-skills/

Quickstart

Job 1 — Audit a skill before installing

Fast (browser): paste the skill URL/name into UseClawPro Verifier.

Deep (agent): load skill-auditor and give it the target:

1) Paste skills/skill-auditor/SKILL.md into your agent
2) Paste the target skill's SKILL.md
3) Ask: "Audit this skill. Return a SKILL AUDIT REPORT."

The auditor runs a 6-step protocol: metadata & typosquat check → permission analysis → dependency audit → prompt injection scan → network & exfiltration analysis → content red flags.

Verdict: SAFE / SUSPICIOUS / DANGEROUS / BLOCK.

Job 2 — Audit your environment

Load setup-auditor and answer 5 wizard questions about your workspace:

1) Paste skills/setup-auditor/SKILL.md into your agent
2) Answer the wizard: workspace path, host agent, permissions, sandbox, ports
3) Get a SETUP AUDIT REPORT with a fix checklist

The auditor runs a 4-step protocol: credential scan → config audit → sandbox readiness → persistence check.

Verdict: READY / RISKY / NOT_READY.

Install into your host agent

• Codex CLI (global): ln -s "$PWD/skills/skill-auditor" ~/.codex/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" ~/.codex/skills/setup-auditor
• Claude Code (project): ln -s "$PWD/skills/skill-auditor" .claude/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" .claude/skills/setup-auditor
• No tooling: just paste the SKILL.md content into your LLM chat.

Modules are optional: you usually don’t need to install them separately.

Metadata contract

This repo keeps Codex/OpenClaw-compatible frontmatter intentionally small at the top level:

• name
• description
• metadata.*

General skill metadata lives under metadata.*, while audit-specific classification lives under metadata.audit.*. This keeps the frontmatter compatible with Codex-style loaders while still giving us enough structure for catalog export and review.

Example:

---