为OpenClaw生态系统提供以安全为先的技能——由UseClawPro（UseAI.pro）维护。

两项审计技能面向终端用户，以及11个可重复使用的模块（高级检查）。

这些是指令模块（SKILL.md）——它们不会单独运行。将它们加载到主机代理（Codex CLI / Claude Code / OpenClaw）或粘贴到任何大型语言模型聊天中。

快速链接：

• UseClawPro 安全中心：https://useclaw.pro/
• 柱子导引：https://useclaw.pro/guides/openclaw-security/
• 技能验证器（浏览器）：https://useclaw.pro/verifier/
• 认证技能（目录）：https://useclaw.pro/verified-skills/

快速开始

工作1 — 安装前审计一项技能

Fast（浏览器）: 将技能的网址/名称粘贴到 UseClawPro Verifier。

深度（特工）: 加载skill-auditor并给出目标：

openclaw-skills-security

Security-first skills for the OpenClaw ecosystem — maintained by UseClawPro (UseAI.pro).

Two auditor skills for end-users, plus 11 reusable modules (advanced checks).

These are instruction modules (SKILL.md) — they don’t run on their own. Load them into a host agent (Codex CLI / Claude Code / OpenClaw) or paste into any LLM chat.

Quick links:

• UseClawPro security hub: https://useclaw.pro/
• Pillar guide: https://useclaw.pro/guides/openclaw-security/
• Skill Verifier (browser): https://useclaw.pro/verifier/
• Verified Skills (catalog): https://useclaw.pro/verified-skills/

Quickstart

Job 1 — Audit a skill before installing

Fast (browser): paste the skill URL/name into UseClawPro Verifier.

Deep (agent): load skill-auditor and give it the target:

1) Paste skills/skill-auditor/SKILL.md into your agent
2) Paste the target skill's SKILL.md
3) Ask: "Audit this skill. Return a SKILL AUDIT REPORT."

The auditor runs a 6-step protocol: metadata & typosquat check → permission analysis → dependency audit → prompt injection scan → network & exfiltration analysis → content red flags.

Verdict: SAFE / SUSPICIOUS / DANGEROUS / BLOCK.

Job 2 — Audit your environment

Load setup-auditor and answer 5 wizard questions about your workspace:

1) Paste skills/setup-auditor/SKILL.md into your agent
2) Answer the wizard: workspace path, host agent, permissions, sandbox, ports
3) Get a SETUP AUDIT REPORT with a fix checklist

The auditor runs a 4-step protocol: credential scan → config audit → sandbox readiness → persistence check.

Verdict: READY / RISKY / NOT_READY.

Install into your host agent

• Codex CLI (global): ln -s "$PWD/skills/skill-auditor" ~/.codex/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" ~/.codex/skills/setup-auditor
• Claude Code (project): ln -s "$PWD/skills/skill-auditor" .claude/skills/skill-auditor and ln -s "$PWD/skills/setup-auditor" .claude/skills/setup-auditor
• No tooling: just paste the SKILL.md content into your LLM chat.

Modules are optional: you usually don’t need to install them separately.

Metadata contract

This repo keeps Codex/OpenClaw-compatible frontmatter intentionally small at the top level:

• name
• description
• metadata.*

General skill metadata lives under metadata.*, while audit-specific classification lives under metadata.audit.*. This keeps the frontmatter compatible with Codex-style loaders while still giving us enough structure for catalog export and review.

Example:

---